{"action":"created","issue":{"url":"https://api.github.com/repos/bcosca/fatfree/issues/850","labels_url":"https://api.github.com/repos/bcosca/fatfree/issues/850/labels{/name}","comments_url":"https://api.github.com/repos/bcosca/fatfree/issues/850/comments","events_url":"https://api.github.com/repos/bcosca/fatfree/issues/850/events","html_url":"https://github.com/bcosca/fatfree/issues/850","id":90728620,"number":850,"title":"Base->clean() doesn't mitigate XSS/code injection attacks","user":{"login":"Rayne","id":1098733,"avatar_url":"https://avatars.githubusercontent.com/u/1098733?v=3","gravatar_id":"","url":"https://api.github.com/users/Rayne","html_url":"https://github.com/Rayne","followers_url":"https://api.github.com/users/Rayne/followers","following_url":"https://api.github.com/users/Rayne/following{/other_user}","gists_url":"https://api.github.com/users/Rayne/gists{/gist_id}","starred_url":"https://api.github.com/users/Rayne/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Rayne/subscriptions","organizations_url":"https://api.github.com/users/Rayne/orgs","repos_url":"https://api.github.com/users/Rayne/repos","events_url":"https://api.github.com/users/Rayne/events{/privacy}","received_events_url":"https://api.github.com/users/Rayne/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-06-24T16:39:08Z","updated_at":"2015-06-25T10:20:03Z","closed_at":null,"body":"`Base->clean()` doesn't [mitigate XSS/code injection attacks](https://github.com/bcosca/fatfree/blob/9cc485be8db3b2b9d7c1f098db24afd05e5259da/lib/base.php#L779-780) as it doesn't remove malicious tag attributes.\r\n\r\n```php\r\n$f3->route('GET /test/clean', function(Base $f3) {\r\n\techo $f3->clean('<p><a href=\"http://127.0.0.1\" onclick=\"alert(\\'SURPRISE\\');\">Link</a></p>', 'a');\r\n});\r\n```\r\n\r\nGenerates:\r\n\r\n```\r\n<a href=\"http://127.0.0.1\" onclick=\"alert('SURPRISE');\">Link</a>\r\n```\r\n\r\nFor the sake of completeness: `Base->scrub()` is also affected."},"comment":{"url":"https://api.github.com/repos/bcosca/fatfree/issues/comments/115200726","html_url":"https://github.com/bcosca/fatfree/issues/850#issuecomment-115200726","issue_url":"https://api.github.com/repos/bcosca/fatfree/issues/850","id":115200726,"user":{"login":"Rayne","id":1098733,"avatar_url":"https://avatars.githubusercontent.com/u/1098733?v=3","gravatar_id":"","url":"https://api.github.com/users/Rayne","html_url":"https://github.com/Rayne","followers_url":"https://api.github.com/users/Rayne/followers","following_url":"https://api.github.com/users/Rayne/following{/other_user}","gists_url":"https://api.github.com/users/Rayne/gists{/gist_id}","starred_url":"https://api.github.com/users/Rayne/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Rayne/subscriptions","organizations_url":"https://api.github.com/users/Rayne/orgs","repos_url":"https://api.github.com/users/Rayne/repos","events_url":"https://api.github.com/users/Rayne/events{/privacy}","received_events_url":"https://api.github.com/users/Rayne/received_events","type":"User","site_admin":false},"created_at":"2015-06-25T10:20:03Z","updated_at":"2015-06-25T10:20:03Z","body":"Even if the `*` feature would be implemented as mentioned by @KOTRET, it would be superfluous and redundant. The documentation (also on the [website](http://fatfreeframework.com/base#clean)) states, that all tags will be removed except the enumerated ones.\r\n\r\nIt could be possible that the `*` feature was originally designed to allow all tags and remove only non-printable characters."}}