#989 html pass-through security issue?
Some raw HTML can be passed through (although <script> is scrubbed, good). But you might still have something like an innocent link that users click on.
Some raw HTML can be passed through (although <script> is scrubbed, good). But you might still have something like an innocent link that users click on.
Actually maybe not as important, since currently those javascript: links render as href="../javascript:alert()"
We're using the scrubber from FeedParser, which has become the scrubber in htmllib, so i'm pretty confident that it catches most everything you could do.
http://www.feedparser.org/docs/html-sanitization.html
status: open --> closed
milestone: --> GA9