Login

10w0lf · 09-03-2015, 06:22 PM

Hello,
while testing my application with CI 3, i found a bug in XSS clean.

this bug is the quotation mark " does not transform to HTML entities.

for example: when you want to input something with quotation mark in text field and send it.

no problem

look at the image

[Image: 209q7ts.png]

but, what if the user input > (greater than) and some text, then the result becomes like that:

look at the image

[Image: 28v4pcj.png]

Fixation

i think we should add a line in system/core/Security.php at $_never_allowed_str array, like that:

look at the image

[Image: 33xedjo.png]