Last modified: 2006-07-07 05:01:02 UTC
Doing a fuzz stress test of 1.7 rc, found one limited HTML attribute injection: =========================== **#***; <pre dir=mailto:,,,,fffffff}}__TOC__||[[x|y]]"
-------<cite> =========================== HTML result: =========================== <ul><li><ul><li><ol><li><ul><li><ul><li><ul><li><dl><dt> <pre dir="mailto:,,,,fffffff}}__TOC__||[[x|y]]" </dt></dl> </li></ul> </li></ul> </li></ul> </li></ol> </li></ul> </li></ul> <p>-------<cite"> =========================== (i.e. the </dt>, </dl>, </li>, </ul>, </ol>, <p> tags are injected). Also generates a Tidy error. P.s. My gut suspicion is that we're approaching the last of the injectable stuff using the Parser.
Fixed at r15399 on trunk, r15400 on REL1_7 branch. Shouldn't affect 1.6, if I understand the issue properly. (Though extensions could have similar problems.)
Thank you!