[Split from] BBCode "XSS security issue"

Get help developing custom BBCodes or request one.
Post Reply
Skydriver
Registered User
Posts: 12
Joined: Sun Apr 28, 2013 11:04 am

[Split from] BBCode "XSS security issue"

Post by Skydriver »

Original topic: viewtopic.php?f=46&t=2129340
Erik Frèrejean wrote:
Robotics Guy wrote:Thanks, I've been reading through that thread. Is it only within an HTML attribute (like border="this is where it's unsafe")that TEXT is unsafe to use?
It is, using {TEXT} outside of HTML tags isn't an issue.

Problem:

Code: Select all

<foo bar="{TEXT}">
No problem:

Code: Select all

<foo>{TEXT}</foo>
In the second case, there is still a warning after having created the BBCode. So we can just ignore that warning if the {TEXT} Token ist in between the two html tags like you discribed:

No problem:

Code: Select all

<foo>{TEXT}</foo>
Thank you for the reassurance ;)
User avatar
Mick
Support Team Member
Support Team Member
Posts: 22744
Joined: Fri Aug 29, 2008 9:49 am
Location: Watching cricket probably.

Re: [Split from] BBCode "XSS security issue"

Post by Mick »

Please don't reply to two year old topics marked as Image, start your own.
"The more connected we get the more alone we become" - Kyle Broflovski©
Skydriver
Registered User
Posts: 12
Joined: Sun Apr 28, 2013 11:04 am

Re: [Split from] BBCode "XSS security issue"

Post by Skydriver »

Mick wrote:Please don't reply to two year old topics marked as Image, start your own.
Sorry and THX for moving it into a new thread ;)
User avatar
Mick
Support Team Member
Support Team Member
Posts: 22744
Joined: Fri Aug 29, 2008 9:49 am
Location: Watching cricket probably.

Re: [Split from] BBCode "XSS security issue"

Post by Mick »

Skydriver wrote:thread
Topic, there no threads WITH phpBB.
"The more connected we get the more alone we become" - Kyle Broflovski©
User avatar
Lumpy Burgertushie
Registered User
Posts: 68113
Joined: Mon May 02, 2005 3:11 am
Contact:

Re: [Split from] BBCode "XSS security issue"

Post by Lumpy Burgertushie »

just use SIMPLETEXT instead and then you do not have to worry about it at all.

there is no benefit to using TEXT over using SIMPLETEXT.


robert
I'm baaaaaccckkkk. still doing work on donation basis. PM your needs.

Premium phpBB 3.3 Styles by PlanetStyles.net

If nobody is in the forest, does a tree really fall?
Skydriver
Registered User
Posts: 12
Joined: Sun Apr 28, 2013 11:04 am

Re: [Split from] BBCode "XSS security issue"

Post by Skydriver »

Lumpy Burgertushie wrote:just use SIMPLETEXT instead and then you do not have to worry about it at all.

there is no benefit to using TEXT over using SIMPLETEXT.
The Problem is that table BBCodes don't work with the SIMPLETEXT or INTEXT token.
User avatar
Lumpy Burgertushie
Registered User
Posts: 68113
Joined: Mon May 02, 2005 3:11 am
Contact:

Re: [Split from] BBCode "XSS security issue"

Post by Lumpy Burgertushie »

Skydriver wrote:
Lumpy Burgertushie wrote:just use SIMPLETEXT instead and then you do not have to worry about it at all.

there is no benefit to using TEXT over using SIMPLETEXT.
The Problem is that table BBCodes don't work with the SIMPLETEXT or INTEXT token.
please provide an example of what you are saying does not work.


robert
I'm baaaaaccckkkk. still doing work on donation basis. PM your needs.

Premium phpBB 3.3 Styles by PlanetStyles.net

If nobody is in the forest, does a tree really fall?
Skydriver
Registered User
Posts: 12
Joined: Sun Apr 28, 2013 11:04 am

Re: [Split from] BBCode "XSS security issue"

Post by Skydriver »

Lumpy Burgertushie wrote:please provide an example of what you are saying does not work.
The following table BBCodes only work with the TEXT token, not with INTEXT or SIMPLETEXT...

BBCode

Code: Select all

[table]{TEXT}[/table]
HTML Replacement

Code: Select all

<table><!-- {TEXT} --></table>
______________________

BBCode

Code: Select all

[td]{TEXT}[/td]
HTML Replacement

Code: Select all

<td>{TEXT}</td>
________________________

BBCode

Code: Select all

[th]{TEXT}[/th]
HTML Replacement

Code: Select all

<th>{TEXT}</th>
__________________________

BBCode

Code: Select all

[tr]{TEXT}[/tr]
HTML Replacement

Code: Select all

--><tr>{TEXT}</tr><!--
Post Reply

Return to “Custom BBCode Development and Requests”