Forgot your password?
New user?
Document Actions
#1: Use scrubhtml to remove dangerous tags
- Contents
CMFDefault is using a SGML Parser to remove harmful tags like script and object. ATCT should use a output transformation to achieve the same goal to work around site exploits
- Proposed by
- Tiran
- Proposal type
- Architecture
- Assigned to release
- State
- completed
Motivation
script and similar tags can be abused to hack a site.
Proposal
Use a SGML parser and a output transformation to remove the malicious tags
Implementation
* Write a better SGML parser than the one from CMFDefault. It has some issues like raising an exception for script or using str + str.
* use this transformation to output html
Deliverables
updates the portal transforms package
write some unit tests
Risks
it might remove more than we want
