Do not allow the about: URI scheme
Some browsers interpret about: URIs like a limited version of data: URIs. In particular, some versions of Internet Explorer interpret arbitrary HTML content in about: URIs.master
parent
71ccaf0751
commit
a7be7bdf56
|
@ -30,7 +30,7 @@ sub scrubber { #{{{
|
|||
"sip", "sips", "snmp", "tel", "urn", "wais", "xmpp",
|
||||
"z39.50r", "z39.50s",
|
||||
# Selected unofficial schemes
|
||||
"about", "aim", "callto", "cvs", "ed2k", "feed", "fish", "gg",
|
||||
"aim", "callto", "cvs", "ed2k", "feed", "fish", "gg",
|
||||
"irc", "ircs", "lastfm", "ldaps", "magnet", "mms",
|
||||
"msnim", "notes", "rsync", "secondlife", "skype", "ssh",
|
||||
"sftp", "sms", "steam", "webcal", "ymsgr",
|
||||
|
|
|
@ -6,8 +6,12 @@ ikiwiki (2.40) UNRELEASED; urgency=low
|
|||
optional '!' prefix even with prefix_directives off, and use that in
|
||||
the underlay to support either setting of prefix_directives. Add NEWS
|
||||
entry with migration information.
|
||||
* Do not allow the about: URI scheme; some browsers interpret about:
|
||||
URIs like a limited version of data: URIs. In particular, some
|
||||
versions of Internet Explorer interpret arbitrary HTML content in
|
||||
about: URIs.
|
||||
|
||||
-- Josh Triplett <josh@freedesktop.org> Sat, 09 Feb 2008 23:01:19 -0800
|
||||
-- Josh Triplett <josh@freedesktop.org> Sun, 10 Feb 2008 13:18:58 -0800
|
||||
|
||||
ikiwiki (2.31.2) unstable; urgency=high
|
||||
|
||||
|
|
Loading…
Reference in New Issue