defendtheweb / hackthis.co.uk

HackThis!!
http://www.hackthis.co.uk
Other
46 stars 55 forks source link

Post body can break out of containing div element. #191

Open dloser opened 8 years ago

dloser commented 8 years ago

Since commit 2aa3799a96f781044396fcf6ed1e05d4f5350646, one can generate an arbitrary amount of

elements in a post.

Example code: [code][left]...[left][/code][/left]...[/left]oops

Example output (edited): <div class="bbcode_code"><pre><div>...<div></pre></div></div>...</div>oops

Here the </pre> effectively closes the inner <div> elements, leaving the outer </div> elements unmatched.

Some people, when confronted with a problem, think "I know, I'll use regular expressions." Now they have two problems.