bugMHonArc - Bugs: bug #373, Non-HTML data looking like URLs...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #373: Non-HTML data looking like URLs can be modified.

Submitted by:  Earl Hood <ehood>
Submitted on:  Fri 10 May 2002 05:18:18 AM UTC  
 
Category: MIME FilterSeverity: 1 - Wish
Priority: 1 - LaterItem Group: Undesired Behavior
Status: Wont FixPrivacy: Public
Assigned to: Earl Hood <ehood>Open/Closed: Closed
Operating System: AllPerl Version: 
Component Version: Fixed Release: 

Fri 26 Jul 2002 07:41:39 PM UTC, comment #1:

I plan to never fix this since security is more important.
I also think that it is not worth the performance hit to do
full HTML parsing to fix the problem.

If someone ends up contributing a filter that does full
parsing and other snazzy stuff, I have no objects in
including it in the MHonArc distribution.

Earl Hood <ehood>
Project AdministratorIn charge of this item.
Fri 10 May 2002 05:18:18 AM UTC, original submission:

Non-HTML tag data that matches image/auto-loaded attribute strings (e.g: src="...") can be modified during CID url resolution or URL rewriting during base href resolution within the mhtxthtml.pl filter.

A complete solution would require full HTML parsing, but this would incur a performance penalty. The current set of regular expressions are intended to deal with security issues but minimize any performance penalties. Unclear if existing html filter should be modified or a separate, more robust filter, can be created, and allow users to choose which one they want. Contributors welcome for developing a robust HTML filter.

Earl Hood <ehood>
Project AdministratorIn charge of this item.

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

Do you think this task is very important?
If so, you can click here to add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.

 

Please enter the title of George Orwell's famous dystopian book (it's a date):

 

 

Follow 3 latest changes.

Date Changed By Updated Field Previous Value => Replaced By
Fri 26 Jul 2002 07:41:39 PM UTCehoodStatusNone=>(Error - Not Found)
  Open/ClosedOpen=>(Error - Not Found)
  Closed on-=>-

Back to the top


Powered by Savane 3.1-cleanup1