3 ms·
You need to improve your XSS protection. Here's an example page I created where I do XSS through the CSS: http://wrttn.in/214018 http://wrttn.in/214018 In the
by Sephr 16y ago
You need to improve your XSS protection. Here's an example page I created where I do XSS through the CSS: http://wrttn.in/214018 http://wrttn.in/214018
In the admin page, you should be able to change the type of markup the content is in (be it Textile or Markdown) and the CSS. Also, I haven't tested it; if you don't support Markdown Extra, add support for it. The best library that I recommend for this is Discount (http://www.pell.portland.or.us/~orc/Code/discount/ http://www.pell.portland.or.us/~orc/Code/discount/)
- jmonegro 16y agoI have basic XSS protection from the main area, but didn't realize I had to protect the CSS field. Thank you for that. This is why I love getting feedback from HN: most of the time you will find something I'd overlooked. edit: and yes, I'm using Discount (RDiscount, actually, it's running on Ruby)