CodeIgniter and XSS protection

[eluser]Padraic Brady[/eluser]

At the end, look again at my previous post, and you will find that I think, introductory articles on security issues such as yours, must be apreciated. The only objections have come from me, how can you have a conclusion, later, which connects the “security vulnerabilities” with “CodeIgniter developers” as “Responsible vendors” ? It doesnt make any sense for me. Its really like a mechanic who blame the hammer and screwdriver (his own equipment) when the door that he made were poor and resulted in his house robbed.

I'm not sure how you're interpreting my blog post so I'll clarify. My point was simply that distributing an XSS sanitiser which, in all probability, has undiscovered security vulnerabilities is not the mark of a responsible vendor (in this case, EllisLab and/or the CodeIgniter developers responsible for this function). Bear in mind my security report specifically recommended deprecating and removing the XSS sanitiser due to its high risk of being compromised. Let's be brutally honest here that EllisLab is not alone. PEAR, for example, continues to distribute a package called HTML_Safe which I also recommmended be removed - and it is an entire order of magnitude worse than CodeIgniter's XSS sanitiser. Would you call PEAR responsible?

It is simply my opinion that shipping risky software and downplaying the security impact of reported vulnerabilities (whether though innocent omission or not) is an irresponsible act. I'm trying to help here. I committed time to reviewing CodeIgniter at no cost and, despite having no reply from a developer, still kept my mouth shut for six weeks giving them all the time in the world to take action. The only reason I even blogged it is because of the lack of accurate disclosure.

As a user you should be asking EllisLab why some guy could report 7-8 vulnerabilities in the first place and how they will ensure such a security scenario will be actively prevented going forward. Hoping something is secure does not make it so, and the next review may not be performed by someone as friendly .