EllisLab text mark
Advanced Search
     
xss_clean stripping ‘/’ from self-closing tags
Posted: 26 August 2008 04:20 PM   [ Ignore ]
Avatar
Joined: 2008-08-25
3 posts

This might not be a bug…

I have set global_xss_filtering to true in my config.php and have noticed that it removes the forward slash at the end of self closing tags.

Has anyone any idea what I modify to stop then from being stripped?

 
Posted: 26 August 2008 04:36 PM   [ Ignore ]   [ # 1 ]   [ Rating: 0 ]
Avatar
Joined: 2006-03-23
3194 posts

could you give an example of how to re-create?  Just submit “<something >”?

 Signature 

DerekAllard.com - CodeIgniter, ExpressionEngine, and the World of Web Design

 
Posted: 26 August 2008 06:04 PM   [ Ignore ]   [ # 2 ]   [ Rating: 0 ]
Avatar
Joined: 2008-08-25
3 posts

Yes, I am trying to add <img src=“whatever” height=“100” width=“100” alt=“something” /> and the forward slash is being removed.

EDIT: I just noticed it is happening in these forum posts too…. If you add an image tag without converting the < and > to html entities and then try to edit your post, you will see the forward slash no longer exists in the edit.

 
Posted: 26 August 2008 11:33 PM   [ Ignore ]   [ # 3 ]   [ Rating: 0 ]
Avatar
Joined: 2006-03-23
3194 posts

Oh, its for images.  Yes, I know what this is.  Its from the input library around 686.  I’ll need to look into this in more detail.  Is this “mission critical” for you?  I may be able to help you with a workaround if so.

 Signature 

DerekAllard.com - CodeIgniter, ExpressionEngine, and the World of Web Design

 
Posted: 27 August 2008 05:41 AM   [ Ignore ]   [ # 4 ]   [ Rating: 0 ]
Avatar
Joined: 2008-08-25
3 posts

It’s not mission critical… I’ve only got a silly little blog that I’m playing with and it was making my XHTML invalid. In the meantime I’ve just changed the values in the DB hah!

Please keep me posted though smile

I’ll have a poke around line 686 later today and see if I can resolve it temporarily.

 
Posted: 27 August 2008 10:47 AM   [ Ignore ]   [ # 5 ]   [ Rating: 0 ]
Avatar
Joined: 2002-06-03
6434 posts

Fixed in the SVN, you can grab the new file from the repository, JJenZz.  Thanks for reporting!