AfflictionNetworks/samskivert
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Don't let people trick our html widget into thinking something's commented

Browse Source 
out by sneaking a "->" into the end of a font, img, or href tag.


git-svn-id: https://samskivert.googlecode.com/svn/trunk@1660 6335cc39-0255-0410-8fd6-9bcaacd3b74c
This commit is contained in:
ray
2005-06-21 19:24:36 +00:00
parent a0268025f9
commit c6d25758e3
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
projects/samskivert/src/java/com/samskivert/util/StringUtil.java
+3 -3
View File
@@ -166,16 +166,16 @@ public class StringUtil
allow.add("<b>"); allow.add("</b>");
allow.add("<i>"); allow.add("</i>");
allow.add("<u>"); allow.add("</u>");
allow.add("<font [^<>]+>"); allow.add("</font>");
allow.add("<font [^<>]*[^<>-]>"); allow.add("</font>");
allow.add("<br>"); allow.add("</br>");
allow.add("<p>"); allow.add("</p>");
allow.add("<hr>"); allow.add("</hr>");
}
if (allowImages) {
allow.add("<img [^<>]+>"); allow.add("</img>");
allow.add("<img [^<>]*[^<>-]>"); allow.add("</img>");
}
if (allowLinks) {
allow.add("<a href=[^<>]+>"); allow.add("</a>");
allow.add("<a href=[^<>]*[^<>-]>"); allow.add("</a>");
}
String[] regexes = new String[allow.size()];