Filter xss

This is by design, and is to ensure that there is no XSS content in the caption area.

Must this 'page' appear in my TOP Pages report ?
I dont like it... can i remove it since im the only user, so no XSS possibilities here

IMHO, that's a weak design as all the filtering could be done beforehand? It creates unnecessary traffic en statistics, which is quite annoying.

The filtering can't be done beforehand as a user can enter in any text they want in a comment or elsewhere. We can't trust user entered data like that and so it has to be filtered when Lightbox2 goes to display it.

Still, the filtering could be done beforehand. So, the current implementation is still unefficient and annoying.

AFAICT the strings passed on to Lightbox.filterXSS() are in many cases derived from the title attribute of a tags. This attributes may only contain plain text, not HTML markup, so it should be sufficient to pass these strings through Drupal.checkPlain(). Only texts extracted by parseRel() may need the filtering, right?

I was thinking something like this patch. This preserves the functionality but avoids calling filterXSS() unless the caption is derived from the rel attribute (because title attributes does not allow HTML, so they can just be passed through Drupal.checkPlain()). Also, we bypass the AJAX call if the caption is empty as suggested in #1298354: Reduce Extra ajax call when the caption is empty.

Note that the code preserves a small bug. If there is no title attribute, the caption specified in the rel attribute is used in the alt attribute, even though the caption is HTML and the alt attribute contains plain text. If we had a strip_tags() equivalent in JS, we could use that. However, this is a separate issue.

Hello,
I get an XSS issue when using: ö"onmouseover=alert(document.domain)// the response was still being reflected in the HTML and you can still change the cookie value to '"()&%alert(document.domain) for example, you think there is anyway to prevent that?