Tickets :: Comment on [#8715] XSS vulnerability

* Your Email Address
* Spam protection	Enter the letters below: ._. ..___..__.. . \| \| \| \| \|\| \| _\|_\__\| \| \|__\\|__\|
Comment	>> I don't have a better suggestion for you, so I just leave the comment >> that blacklisting can be dangerous. > > Of course attempting to blacklist HTML attributes/elements to fix all > security issues is dangerous. That is why we disable HTML inline > viewing by default. But a large portion of users want/need this > inline display and are willing to view these parts even with the > understanding that the filtering may not be 100% accurate. > > That being said, thanks for your examples. It is clear that we need > to filter any data information contained in the href parameter. > > I'm going to go ahead and add this to git and CVS FW_3. Will leave > this ticket open for a few days for additional feedback.
Attachment
Watch this ticket