commit 033ef02392d70dbc873deacc50ee76a800d0d228
author paulburdick <devnull@localhost> Tue Jun 26 21:52:52 2007 +0000
committer paulburdick <devnull@localhost> Tue Jun 26 21:52:52 2007 +0000
tree dd51eaed9c17f54d4cdb0a7ee4eca553e21f46b9
parent 85d9f0c9960188aa9916c499466c32279178be41

*Updated the XSS Filtering to take into account the IE expression() ability

system/libraries/Input.php

diff --git a/system/libraries/Input.php b/system/libraries/Input.php
index 1ff72877b..dc4e605 100644
--- a/system/libraries/Input.php
+++ b/system/libraries/Input.php
@@ -528,9 +528,12 @@
 		 */	

 		$bad = array(

 						'document.cookie'	=> '[removed]',

+						'.parentNode'		=> '[removed]',

+						'.innerHTML'		=> '[removed]',

 						'document.write'	=> '[removed]',

 						'window.location'	=> '[removed]',

 						"javascript\s*:"	=> '[removed]',

+						"expression\s*\("	=> '[removed]', // CSS and IE

 						"Redirect\s+302"	=> '[removed]',

 						'<!--'				=> '&lt;!--',

 						'-->'				=> '--&gt;'

@@ -626,7 +629,7 @@
 		 * Becomes:		eval&#40;'some code'&#41;

 		 *

 		 */

-		$str = preg_replace('#(alert|cmd|passthru|eval|exec|system|fopen|fsockopen|file|file_get_contents|readfile|unlink)(\s*)\((.*?)\)#si', "\\1\\2&#40;\\3&#41;", $str);

+		$str = preg_replace('#(alert|cmd|passthru|eval|exec|expression|system|fopen|fsockopen|file|file_get_contents|readfile|unlink)(\s*)\((.*?)\)#si', "\\1\\2&#40;\\3&#41;", $str);

 						

 		/*

 		 * Final clean up

@@ -637,9 +640,12 @@
 		 */	

 		$bad = array(

 						'document.cookie'	=> '[removed]',

+						'.parentNode'		=> '[removed]',

+						'.innerHTML'		=> '[removed]',

 						'document.write'	=> '[removed]',

 						'window.location'	=> '[removed]',

 						"javascript\s*:"	=> '[removed]',

+						"expression\s*\("	=> '[removed]', // CSS and IE

 						"Redirect\s+302"	=> '[removed]',

 						'<!--'				=> '&lt;!--',

 						'-->'				=> '--&gt;'