Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

(Update) Remove XSS cleaner and remove XSS vulnerabilities #3222

Open
wants to merge 1 commit into
base: 8.x.x
Choose a base branch
from
Open

(Update) Remove XSS cleaner and remove XSS vulnerabilities #3222

wants to merge 1 commit into from

Commits on Jul 3, 2024

  1. update: remove XSS cleaner and remove XSS vulnerabilities 

    We've been mostly relying on the 3rd party xss cleaner to make sure user submitted content is clean. This PR fixes up any leftover holes in the bbcode parser that allow xss vulnerabilities, and as a result, the 3rd party library isn't needed anymore. It cleans responsibly by first, running `htmlspecialchars()` over the content, followed by sanitizing the untrusted urls and whitelisting their protocol.
    @Roardom
    Roardom committed Jul 3, 2024
    Configuration menu
    Copy the full SHA
    011d07e View commit details
    Browse the repository at this point in the history