Zend Framework

• Type: Bug
• Status: Resolved
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: None
• Fix Version/s: 1.7.9, 1.8.5, 1.9.7
• Component/s: Zend_Filter
• Labels:

  None

Currently, the StripTags filter allows optionally allowing comments. However, this should never be allowed, as it's possible to perform IE-style conditional comments that could open XSS attack vectors:

$filter = new Zend_Filter_StripTags;                                                                          
$filter->setCommentsAllowed(true);                                                                            
$html = "<!--[if gte IE 4]><SCRIPT>alert('XSS');</SCRIPT><![endif]-->";                                       
$out = $filter->filter($html);
// results in:
// <!--[if gte IE 4]><SCRIPT>alert('XSS');</SCRIPT><![endif]-->

• Assignee:

  Matthew Weier O'Phinney

  Reporter:

  Matthew Weier O'Phinney

• Created:

  07/Jan/10 1:50 PM

  Updated:

  11/Jan/10 1:06 PM

  Resolved:

  07/Jan/10 2:55 PM