search

esotalk / esoTalk

Fat-free forum software.
GNU General Public License v2.0
1.47k stars 239 forks source link

Fix XSS in BBcode, issue #401 #424

Closed jgknight closed 9 years ago

jgknight commented 9 years ago

This fixes #401 where the regex/order of BBcode allows injection of javascript, introducing the possibility of Cross Site Scripting (XSS) attacks.

I've tested this on my dev setup, and it blocks the current example XSS. I was unable to exploit it after this patch.

jgknight commented 9 years ago

No objections, so I'll merge it :)