Description

inlining .txt files does not escape html in theme. This is a security bug, any one can add any html markup to any page.

Example

Here is a stupid but effective example :-) 

   1 <script type="text/javascript">
   2 // Have fun with colors
   3 function colorize(color){
   4     e = document.getElementById('page');
   5     if (color == 'red') {
   6         e.style.cssText = 'color: white; background: red;';
   7         setTimeout("colorize('white')", 100);
   8     } else {
   9         e.style.cssText = 'color: red; background: white;';
  10         setTimeout("colorize('red')", 100);
  11     }    
  12 }
  13 document.write('<h1>Escape Me!</h1>');
  14 colorize('red');
  15 </script>
bad.txt

Details

MoinMoin Version

Workaround

Discussion

Plan

CategoryMoinMoinBugFixed

MoinMoin: MoinMoinBugs/InlineTxtNotEscpaed (last edited 2007-10-29 19:09:17 by localhost)