Bad home brew implementations of BB code (especially in PHP) are a common source of XSS vulnerabilities. Usually they rely on a bunch of regexes, a tool that is not fit for the job.

But lo and behold - there is a PHP extension for converting BB code into HTML! The documentation contains code like this, that raises question about escaping attribute values, javascript: URLs, etc.:

'url' => array('type'=>BBCODE_TYPE_OPTARG,
            'open_tag'=>'<a href="{PARAM}">', 'close_tag'=>'</a>',

Is this extention reasonably safe against XSS? What sort of usage of it can be considered safe? What features should be avoided or used with care? Should I plug the output into HTML purifier just to be sure?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.