Re: [Zope-Coders] Re: [Zope-dev] DTML and REQUEST data changes about to be checked in

On Friday 09 Aug 2002 4:33 pm, Tres Seaver wrote:

Whithout the fix, virtually every Zope site in the world is vulnerable to URL-based cross-site scripting exploits. For instance, any URL which contains invalid form variable marshalling can generate an error page which includes the erroneous value, unquoted. E.g.:

<URL:http://somezopesite.com/looks/like/legitimate?foo:int=%3Cscript%3Ealer t('Owned')%3C/script%3E>

Do you plan to fix this bug? Or, with the autoquoting changes, is this to be reclassified as 'not a bug'?