example: http://blogru.nikanorov.com/articles/2004/05/31/%D0%98%D0%B7-code-reading-the-open-source-perspective#comments

Can't reproduce here: http://blog.leetsoft.com/articles/2005/11/10/oh-so-wrong#comments

Only trunk?

Same thing on dev box. Not textdrive problem.

Ugly temp patch:

===================================================================
--- app/models/comment.rb       (revision 759)
+++ app/models/comment.rb       (working copy)
@@ -30,6 +30,6 @@

   def make_nofollow
     self.author = nofollowify(author)
-    self.body_html = nofollowify(body_html.to_s)
+    self.body_html = nofollowify(strip_html(body_html.to_s))
   end
 end

nikanorov - you can actually reproduce at blog.leetsoft.com except it does the same thing my blog does, which is it turns " into an entity, so the alert() is no longer valid, but other tricks would work.

I can also reproduce on my installs. The patch does fix the issue but it is still valid if the user clicks preview. I don't know how critical the Preview part would be (i.e. could it 'DROP * FROM xxxx' ?).

Pre-patch Rake passed all tests.
Post-patch Rake failed 3 tests, 2 related to Spam and one related to the Textile (stripping the tags).

>The patch does fix the issue

Strange. I also test this: http://cvs.wackowiki.com/wsvn/repo/trunk/safehtml/tests/testcases2.txt?op=file&rev=0&sc=0

>Post-patch Rake failed 3 tests, 2 related to Spam and one related to the Textile (stripping the tags).

That's why it's ugly temp patch =)

>The patch does fix the issue but it is still valid if the user clicks preview.

Sorry, same thing. But I it's minor.

>i.e. could it 'DROP * FROM xxxx' ?
Could not.

I'm still unpacking, but I'll try to get to this as soon as possible. The temp patch should be okay, although I'll probably do it a bit differently.

(In r763) Really, really strip Javascript from comments. Closes #551

Sadly this doesn't fix the problem because sanitize isn't rigorous enough :( I filed a ticket against rails, but thought I'd mention it here ... Until it's fixed, I recommend using escapehtml(html) or ActionView::Helpers::TextHelper.strip_tags(html) . I'm marking the ticket as re-opened for now. Depending on the RoR response it might be appropriate to just close it again.

(In r1077) Greatly improved XSS filtering for comments. Closes #551