I decided that it would be wiser to turn on the global_xss_filtering, but unfortunately, about 1% of my users had password mismatch issues. I tracked it down to the fact that some md5’s were being generated differently when the XSS filter was on.
Here is my test controller code:
function testing()
{
$data['version'] = CI_VERSION;
$data['testing'] = $this->input->post('testing');
$data['testing_xss'] = $this->input->post('testing', TRUE);
$data['md5_testing'] = md5($this->input->post('testing'));
$data['md5_testing_xss'] = md5($this->input->post('testing', TRUE));
$this->load->view('testing', $data);
}
And here is my test view code:
<?php
echo form_open('welcome/testing');
echo '<p>' . $version . '</p>';
echo 'Testing: ' . form_input('testing', set_value('testing'));
echo form_submit('submit','Submit');
echo form_close();
if ($testing)
{
echo "Testing: " . $testing . '<br>';
echo "Testing XSS: " . $testing_xss . '<br>';
echo "MD5 Testing: " . $md5_testing . '<br>';
echo "MD5 Testing XSS: " . $md5_testing_xss . '<br>';
}
?>
One of the combinations that seems to cause the issue is if the value has “&sq;” in it. For example here is the output of a page with that value submitted:
1.7.2
Testing:
Testing: &sq;
Testing XSS: &sq;
MD5 Testing: af6c44d3d1bb087f014d1bcb5916f6a4
MD5 Testing XSS: 3247fc1749af230a49e4d19cda68c6fa
Now, if I run &sq; through md5 in my command line, I get the value that matches when the XSS filter is off: af6c44d3d1bb087f014d1bcb5916f6a4
Is this a bug? What exactly is the XSS filter turning my text into that md5() is generating a different hash for it?
