[dokuwiki] Re: XSS vulnerabilities in plugins?

On Sun, 27 Apr 2008 03:25:57 +0200
Mischa The Evil <mischa@xxxxxxxxxxxxxxxx> wrote:

> Hi list,
> 
> 
> Is it correct to say that all syntax-plugins which use
> 
> if(!defined('DOKU_INC')) 
> define('DOKU_INC',realpath(dirname(__FILE__).'/../../').'/');
> if(!defined('DOKU_PLUGIN'))
> define('DOKU_PLUGIN',DOKU_INC.'lib/plugins/');
> require_once(DOKU_PLUGIN.'syntax.php');
> 
> instead of
> 
> if (!defined('DOKU_INC')) die();
> if (!defined('DOKU_PLUGIN')) define('DOKU_PLUGIN',
> DOKU_INC.'lib/plugins/'); require_once(DOKU_PLUGIN.'syntax.php');
> 
> have a XSS vulnerability which allows arbitrary (JavaScript)
> insertion?

No. This has nothing to do with XSS at all. XSS vulnerabilities are
opened when user provided input is written unescaped and unfiltered to
the HTML. The above is not harmful, it's just bad style and might break
the plugin in certain setups.

Again, I encourage every plugin developer to read up on XSS and make
sure their plugins are safe. There are a lot of very good explanations
of what XSS is and how to avoid it available on the web.

Andi
-- 
DokuWiki mailing list - more info at
http://wiki.splitbrain.org/wiki:mailinglist

Other related posts: