Suspicious HTML in default user-specific options template

[David H. Brown]

The line

    <link rel="SHORTCUT ICON" href="<mm-favicon>">

appears near the top of the default user-specific options template in various languages including en, es, and fr. The link tag is flagged as a HTML _badwords in line 898 of Utils.py.

The consequence is most attempts to edit the user-specific options template via the web-based administrative interface will result in a "suspicious html" error. The easiest solution would be to remove the <link...> from the templates.

A better solution could be to allow the site administrator to override the warning. (Perhaps I will try to write such a patch once I'm a little more familiar with Python.)

(A too-good-to-be-true solution would be to figure out how to actually detect vulnerable HTML rather than simply identify tags and attributes that could be abused...)

[David H. Brown (dave-davidhbrown)]

Forgot to mention... the site I have running is using version 2.1.10; I also checked the code in 2.1.11 Version 3.0.0.a2 seems to be using a much smaller set of checks, possibly just disallowing the <script> tag? From edithtml.py part of def ChangeHTML :

   code = re.sub(r'<([/]?script.*?)>', r'&lt;\1&gt;', code)

(2.1.11 has if Utils.suspiciousHTML(code):...)

[Mark Sapiro (msapiro)]

This duplicates the SF bug at <http://sourceforge.net/tracker/index.php?func=detail&aid=2164798&group_id=103&atid=100103> which was posted after the move to launchpad.

This is fixed in the Mailman 2.1 branch at rev 1145. The fix is in Mailman 2.1.12rc1.

The suspiciousHTML code is not in the 3.0 branch because there will be a redesigned GUI in 3.0 and no GUI related changes have been ported forward.