0xDECAFBAD

It's all spinning wheels and self-doubt until the first pot of coffee.

MTCleanHTMLPlugin - borrowing a page from LJ, literally.

Tonight, I borrowed LiveJournal's comment filtering code and made it into a MovableType plugin: MTCleanHTMLPlugin



After all that ramble about having open system and not having been the victim of an exploit, SamRuby inadvertently revealed one gapingly wide hole for me. Not that he did anything to exploit it - I just realized that a bug he tripped over could be used for more nefarious purposes. So, I closed the hole, and after a bit of quick research went a bit further and made a new MovableType plugin. Borrowing LiveJournal's code yields a filter which strips out most nasty ?JavaScript exploits, and attempts to close tags left lazily open.



Hope someone finds a use for it.

shortname=ooobif

Archived Comments

  • Jeff Szymona
    Should this tag be wrapped around the TrackBack pings also?
  • l.m.orchard
    Hmm, that might not be such a bad idea. Really, wherever you allow content submitted by someone other than you, you should use this tag (or something like it).
  • Jeff Szymona
    Well, I didn't think at first, but at least what I do is include a call to the cgi with php, so it wouldn't work anyway. Maybe the logic could be (or already is) included there. I haven't looked at the source yet, but then I'm just learning Perl now, so I don't know if I would identify the right spot yet :)
  • nf0
    Thanks for another good one!
  • john
    l.m. so, I'm looking at the instructions and where I see this: . |-- README |-- extdir | `-- MT | `-- decafbad | `-- cleanhtml.pm `-- plugins `-- cleanhtml.pl I'm perplexed. I don't have an extdir directory. I have an extlib directory, but it doesn't have an MT in it... so, where does all of this stuff go, off your root MT installation? Thanks, John (I really just want to be an end user, but find myself being a hacker, in that I'm being forced to install hacks on a piece of software in a language I know very little about.)
  • nf0
    John, you can put it under extlib. If you don't have an MT subdir in there then you can just create one, then another subdir called decafbad. Also if you don't have the plugins directory in your root MT folder you'll have to create that one as well. Hope that helps
  • l.m.orchard
    D'oht, good catch John - it's supposed to be "extlib", not "extdir". I'll see about updating that today! Sorry about that!