I had permitted the style tag for all logged in users. According to http://www.feedparser.org/docs/html-sanitization.html this is dangerous but was not listed in the security report in the Help tab. What was listed there was the tr tag. How could this table row tag be dangerous?

Comments

coltrane’s picture

coltrane
he/him
commented
Status: Active » Closed (works as designed)

security_review_unsafe_tags() in the module includes the style tag, so it is indeed searched for. Table tags, like tr, are also included because of some of attributes that are allowed. The sanitization filter that Drupal uses does a good job of filtering, but it's not perfect.

Feel free to reopen if you think there's still a bug.

spflanze’s picture

spflanze commented
Status: Closed (works as designed) » Active

Does the dangerous tr tag mean Drupal's own web site has a security vulnerability? The tr tag does appear as one of the "Allowed HTML tags" of this very Comment field I am typing this message into.

What dangerous attributes does the tr tag have?

greggles’s picture

greggles
he/him
Primary language English
Location Denver, Colorado, USA
commented

The list of vulnerable tags comes from http://ha.ckers.org/xss.html

It depends a bit on how paranoid you are. The table and td tags are mostly a problem on IE6, NS8.1 and Opera 9.02 which are not the most popular browsers on earth but still used quite a bit...

greggles’s picture

greggles
he/him
Primary language English
Location Denver, Colorado, USA
commented
Status: Active » Fixed

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.