Color tag CSS injection

dcwatson / bbcode

A pure python bbcode parser and formatter.

BSD 2-Clause "Simplified" License

68 stars 17 forks source link

Closed Drumm- closed 11 years ago

Drumm- commented 11 years ago

Not a major bug. But you know somebody is going to be able to exploit this: https://github.com/dcwatson/bbcode/blob/master/bbcode.py#L137 is not secure. I can do [color=red; font-size: 1000px]Blah[/color] for example.

dcwatson commented 11 years ago

Thanks for the report. I'll push out a new version shortly.

Drumm- commented 11 years ago

Cheers mate.

dcwatson commented 11 years ago

1.0.12 pushed to PyPI.