commit c715b22eb153aa702b07a158357ee2b13a24cf67
author Andrey Andreev <narf@devilix.net> Fri Jan 24 19:11:31 2014 +0200
committer Andrey Andreev <narf@devilix.net> Fri Jan 24 19:11:31 2014 +0200
tree bd170aa6f69d9202b79644a8ffd5c2872f1d4de1
parent ee7633c9f883513fa556240d60694f075d8dc056

CI_Security: Add <select> and <keygen> tags to the list of 'naughty' HTML elements

system/core/Security.php

diff --git a/system/core/Security.php b/system/core/Security.php
index a753aa0..e085725 100644
--- a/system/core/Security.php
+++ b/system/core/Security.php
@@ -469,7 +469,7 @@
 		 * So this: <blink>
 		 * Becomes: &lt;blink&gt;
 		 */
-		$naughty = 'alert|applet|audio|basefont|base|behavior|bgsound|blink|body|embed|expression|form|frameset|frame|head|html|ilayer|iframe|input|button|isindex|layer|link|meta|object|plaintext|style|script|textarea|title|video|xml|xss';
+		$naughty = 'alert|applet|audio|basefont|base|behavior|bgsound|blink|body|embed|expression|form|frameset|frame|head|html|ilayer|iframe|input|button|select|isindex|layer|link|meta|keygen|object|plaintext|style|script|textarea|title|video|xml|xss';
 		$str = preg_replace_callback('#<(/*\s*)('.$naughty.')([^><]*)([><]*)#is', array($this, '_sanitize_naughty_html'), $str);
 
 		/*