search

turnermm / newpagetemplate

Updated version of newpagetemplate for handling new template Events
http://www.dokuwiki.org/plugin:newpagetemplate
4 stars 3 forks source link

XSS vulnerability in write_msg() #2

Closed splitbrain closed 8 years ago

splitbrain commented 8 years ago

See http://php-grinder.com/vulns/view/1193317

$_REQUEST['newpagetemplate'] is output without escaping.

turnermm commented 8 years ago

escaped output with htmlentities.

turnermm commented 8 years ago

Escaping output string wasn't enough for grinder; I had to use $INPUT to get an OK from it: http://php-grinder.com/project/view/22070

I'm not sure how trustworthy grinder is here. It gives a pass to $INPUT, which it can't access, but not to htmlentities.

splitbrain commented 8 years ago

grinder is a static analyzer. what it finds are possible problems. you have to analyze and asses them yourself.

turnermm commented 8 years ago

Ah, I see. I didn't know what 'static' referred to.