Re: [PEAR-QA] XSS vs HTML_BBCodeParser

[email protected] (Christian Weiske) Mon, 2 Jan 2012 07:44:10 +0100

Newsgroups	php.pear.qa
Message-ID	<20120102074410.2083dcc1@bogo>

Hello Daniel,


> http://pear.php.net/bugs/bug.php?id=14579 is one I just stumbled
> across. I'd apply the fix described, but no doubt there will be other
> ways to subvert it.
> 
> Can we take a look and come up with the best way to fix this
> collectively?

We should look how  htmlpurifier does it.

-- 
Regards/Mit freundlichen Grüßen
Christian Weiske

-=≡ Geeking around in the name of science since 1982 ≡=-

signature.asc (application/pgp-signature, 198 B)

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iEYEARECAAYFAk8BUjoACgkQFMhaCCTq+CM8igCgq5ViqAocPep1dp0I3pny6J4s
I50Ani30DsTkrQswjh4b+EOzCzXPbpPi
=h22p
-----END PGP SIGNATURE-----