Skip to content
This repository has been archived by the owner on Feb 21, 2024. It is now read-only.

Checking answers with special characters will behave strangely #17

Open
betaveros opened this issue Mar 3, 2014 · 0 comments
Open

Checking answers with special characters will behave strangely #17

betaveros opened this issue Mar 3, 2014 · 0 comments
Labels

Comments

@betaveros
Copy link
Contributor

This is due to commit 969a1d3: answers are run through htmlspecialchars before storing. Answer checking tries to only compare letters and numbers, but this way it'll pick up on the letters inside the ampersand escapes and think "<" is equal to "LT". I think this state of affairs is suboptimal, but still better than having weird characters getting injected (accidentally or maliciously) and blow up the interface.

The "straightforward" fix is to store and compare the answers as unescaped plain text and only escape them when displaying, but there seem to be a lot of places this might occur. Perhaps we should just strip special characters from answers more aggressively?

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
Projects
None yet
Development

No branches or pull requests

2 participants