Skip Menu |

This queue is for tickets about the HTML-Defang CPAN distribution.

Report information
The Basics
Id: 105778
Status: new
Priority: 0/
Queue: HTML-Defang

People
Owner: Nobody in particular
Requestors: Laura.Bednarek [...] proquest.com
Cc:
AdminCc:

Bug Information
Severity: (no value)
Broken in: (no value)
Fixed in: (no value)



Subject: Text of math formula is altered
Date: Thu, 9 Jul 2015 18:30:57 +0000
To: "bug-HTML-Defang [...] rt.cpan.org" <bug-HTML-Defang [...] rt.cpan.org>
From: "Laura.Bednarek [...] proquest.com" <Laura.Bednarek [...] proquest.com>
Hi, I noticed that if the text “a math formula where x<2 and then some other text” is sent through HTML::Defang, the output is “a math formula where x2 and then some other text”. This behavior is inconsistent with every other XSS cleaner module I’ve tried so far. I believe this behavior is also inconsistent with itself. If the ‘<’ symbol had been intentionally removed, I would have expected something like “a math formula where x<!--defang_symboldrop-->2 and then some other text”. I think this way because every other alteration I’ve seen from HTML::Defang has used defang comments. I compared output from 5 other perl modules designed to assist with XSS prevention, and this is the only one that removes the symbol in this context. The other modules either convert the symbol to &lt; or leave it alone (it will display properly in a browser as is). Modules that leave the symbol alone: HTML::Restrict, HTML::Detoxifier. Modules that convert the symbol: HTML::StripScripts::Parser, HTML::TagFilter, HTML::Scrubber. Thanks, Laura P.S. I really like this module. It seems well thought out. I think it’s a shame that other people might have a hard time finding it since the link to download the source only works on metacpan, and thus not easily installable with a cpanm command.