You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository has been archived by the owner on Feb 21, 2024. It is now read-only.
This is due to commit 969a1d3: answers are run through htmlspecialchars before storing. Answer checking tries to only compare letters and numbers, but this way it'll pick up on the letters inside the ampersand escapes and think "<" is equal to "LT". I think this state of affairs is suboptimal, but still better than having weird characters getting injected (accidentally or maliciously) and blow up the interface.
The "straightforward" fix is to store and compare the answers as unescaped plain text and only escape them when displaying, but there seem to be a lot of places this might occur. Perhaps we should just strip special characters from answers more aggressively?
The text was updated successfully, but these errors were encountered:
This is due to commit 969a1d3: answers are run through htmlspecialchars before storing. Answer checking tries to only compare letters and numbers, but this way it'll pick up on the letters inside the ampersand escapes and think "<" is equal to "LT". I think this state of affairs is suboptimal, but still better than having weird characters getting injected (accidentally or maliciously) and blow up the interface.
The "straightforward" fix is to store and compare the answers as unescaped plain text and only escape them when displaying, but there seem to be a lot of places this might occur. Perhaps we should just strip special characters from answers more aggressively?
The text was updated successfully, but these errors were encountered: