Support Forum HTML Injection Possible

[aafritz]

Creating a topic that includes html tags breaks this forum… That seems like a bug that should be fixed. It seems like you aren’t scrubbing text that is typed here or properly escaping it on display.

For example, below I’m going to include a li tag in the brackets and text after that will appear outside it on the page to view the thread…

<li>

This is part of my post but appears outside it with broken formatting.

[moderated to fix formatting]

• This topic was modified 6 years, 1 month ago by Steven Stern (sterndata).

[Steven Stern (sterndata)]

Yeah, we know about the <ul> bug, but I’m not able to find the trac ticket.

• This reply was modified 6 years, 1 month ago by Steven Stern (sterndata).

[Jan Dembowski]

It only breaks the formatting and when reported is fixed.

[Ipstenu (Mika Epstein)]

Just to explain, it’s not HTML ‘injection’ it’s just that it breaks the semantic HTML of the forums, which ALSO use UL and LI.