xerofun/owaspantisamy

Linking to .NET URL Munged URL Is blocked

Closed this issue · 1 comments

What steps will reproduce the problem?
1. Create an HTML page with an
href="http://subdomain.domain/(S(ke0lpq54bw0fvp53a10e1a45))/MyPage.aspx"
2. Parse with anythinggoes policy

What is the expected output? 
An href="http://subdomain.domain/(S(ke0lpq54bw0fvp53a10e1a45))/MyPage.aspx"
What do you see instead?
Empty tag

Please provide any additional information below.
The offsiteURL regex doesn't permit brackets. These are valid in the path
according to RFC2396 and http://www.w3.org/Addressing/URL/url-spec.txt.


Original issue reported on code.google.com by PhilMatt...@gmail.com on 21 Aug 2009 at 1:52

This has been verified and fixed in the base policy files. In the meantime, you 
can
add the parentheses to your policy file (see the offsiteURL regexp towards the 
top).

I have also introduced a test case to confirm it. This will be out in the next 
minor
release.

Original comment by arshan.d...@gmail.com on 15 Oct 2009 at 3:54

  • Changed state: Verified
  • Added labels: Priority-High
  • Removed labels: Priority-Medium