Strip closing <script> tags from queries

duckduckgo / p5-app-duckpan

DuckDuckHack OpenSource Development Application

http://metacpan.org/module/App::DuckPAN

Other

54 stars 47 forks source link

Closed moollaza closed 6 years ago

moollaza commented 8 years ago

We've made similar internal changes as a means of preventing XSS for now.

This enable us to no longer require Goodie output to be encoded with html_enc.

The production changes are already live. Now we just need to cleanup all the Goodies 😄

/cc @mintsoft @GuiltyDolphin

zachthompson commented 8 years ago

Is this just for parity with prod? Who but the dev running duckpan would execute one of these?

moollaza commented 8 years ago

Is this just for parity with prod? Who but the dev running duckpan would execute one of these?

@zachthompson yes, for parity with Prod. Without this, you'd see breakage inside DuckPAN for queries containing </script>