urosm
/
ikiwiki
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Do not allow the about: URI scheme 

Some browsers interpret about: URIs like a limited version of data:
URIs.  In particular, some versions of Internet Explorer interpret
arbitrary HTML content in about: URIs.
master
Josh Triplett 2008-02-10 13:23:28 -08:00
parent 71ccaf0751
commit a7be7bdf56
2 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
IkiWiki/Plugin/htmlscrubber.pm
View File

@ -30,7 +30,7 @@ sub scrubber { #{{{
"sip", "sips", "snmp", "tel", "urn", "wais", "xmpp",
"z39.50r", "z39.50s",
# Selected unofficial schemes
"about", "aim", "callto", "cvs", "ed2k", "feed", "fish", "gg",
"aim", "callto", "cvs", "ed2k", "feed", "fish", "gg",
"irc", "ircs", "lastfm", "ldaps", "magnet", "mms",
"msnim", "notes", "rsync", "secondlife", "skype", "ssh",
"sftp", "sms", "steam", "webcal", "ymsgr",

6
debian/changelog vendored
View File

@ -6,8 +6,12 @@ ikiwiki (2.40) UNRELEASED; urgency=low
optional '!' prefix even with prefix_directives off, and use that in
the underlay to support either setting of prefix_directives. Add NEWS
entry with migration information.
* Do not allow the about: URI scheme; some browsers interpret about:
URIs like a limited version of data: URIs. In particular, some
versions of Internet Explorer interpret arbitrary HTML content in
about: URIs.
-- Josh Triplett <josh@freedesktop.org> Sat, 09 Feb 2008 23:01:19 -0800
-- Josh Triplett <josh@freedesktop.org> Sun, 10 Feb 2008 13:18:58 -0800
ikiwiki (2.31.2) unstable; urgency=high