search

Shiva6780 / owaspantisamy

Automatically exported from code.google.com/p/owaspantisamy
0 stars 0 forks source link

antisamy-slashdot-1.3.xml missing escape in offsiteURL regex? #59

Closed GoogleCodeExporter closed 8 years ago

GoogleCodeExporter commented 8 years ago 
What steps will reproduce the problem?
1. Compare antisamy-slashdot-1.3.xml with the other .xml files

What is the expected output? What do you see instead?
In antisamy-1.3.xml I see:
<regexp name="offsiteURL"
value="(\s)*((ht|f)tp(s?)://|mailto:)[\p{L}\p{N}]+[\p{L}\p{N}\p{Zs}\.\#@\$%\+&am
p;;:\-_~,\?=/!]*(\s)*"/>

In antisamy-slashdot-1.3.xml I see:
<regexp name="offsiteURL"
value="(\s)*((ht|f)tp(s?)://|mailto:)[\p{L}\p{N}]+[~\p{L}\p{N}\p{Zs}\-_\.@#$%&am
p;;:,\?=/\+!]*(\s)*"/>

In antisamy-1.3.xml, the '#' and '$' characters are escaped with '\'. In
antisamy-slashdot-1.3.xml they are not. (I believe the regex's are
otherwise equivalent.)

Original issue reported on code.google.com by danr...@gmail.com on 21 Oct 2009 at 4:47

GoogleCodeExporter commented 8 years ago 
Fixed in slashdot and tinymce profiles. Thanks!

Original comment by arshan.d...@gmail.com on 24 Nov 2009 at 3:11