HomePhabricator

Write search bolding in a way which is certainly HTML-safe

Description

Write search bolding in a way which is certainly HTML-safe

Summary:
This algorithm is tricky, and uses phutil_safe_html() directly, which makes it potentially unsafe.

In particular, D8859 fixes a bug with it which caused it to produce non-utf8 output. This doesn't guarantee it's a security problem, but does make it suspicious.

I don't actually see a way to break it, but rewrite it so that it's absolutely bulletproof and does not need to call phutil_safe_html().

Test Plan:

Screen_Shot_2014-04-25_at_12.17.32_PM.png (1×1 px, 166 KB)

@rugabarbo, if you have a chance, can you check if this still works for you?

Reviewers: btrahan

Reviewed By: btrahan

Subscribers: epriestley, rugabarbo

Differential Revision: https://secure.phabricator.com/D8862

Details

Provenance
epriestleyAuthored on
epriestleyPushed on Apr 26 2014, 7:44 PM
Reviewer
btrahan
Differential Revision
D8862: Write search bolding in a way which is certainly HTML-safe
Parents
rP1b0d53ec650f: Fix Differential transaction strengths
Branches
Unknown
Tags
Unknown

Event Timeline