Spam blacklist trivially circumvented using HTML comments
Closed, ResolvedPublic
Actions

Assigned To

None

Authored By

	• bzimport
	Mar 6 2006, 11:40 PM

Description

Author: mapellegrini

Description:
It is trivially easy to circumvent the spam blacklist by using an HTML comment
in the URL.

Version: unspecified
Severity: major

• bzimport raised the priority of this task from to Medium.Nov 21 2014, 9:07 PM

• bzimport set Reference to bz5185.

• bzimport added a subscriber: Unknown Object (MLST).

wiki.bugzilla wrote:

*** This bug has been marked as a duplicate of 4823 ***

De-duping this. These extensions don't share code and work differently,
so have to both be fixed separately.

robchur wrote:

Fixed in trunk, r13601.

mapellegrini wrote:

http:///www.foo.org (notice the three slashes) is also an effective work around.

robchur wrote:

Second exploit should now be fixed in trunk, r13912.