Jan 18, 2005 17:04
How does the S2 code cleaner work? I assume the content is piped through some program and stripped of malicious code, but how do you know which code is malicious? And where is that program located? I searched the CVS repos and the manual but couldn't find it. I'm interested in doing something similar with PHP.
Leave a comment
Comments 14
Reply
is one of them.
Note that LJ code is licensed under the GPL, and so all derivative works must also be under the GPL.
Reply
Reply
[....]
I'd say if no code is actually used from the original, it's not a "derivative work". If so, it seems to my interpretation that we're jumping into the area of patents, in which a process or concept is retained as IP. However, GPL does not concern software patent as far as I know. (And should not, software patents are BAD ;)
Just my 2 cents based on reading the GPL, maybe I missed something, I'd love for someone to point out any flaws in my logic there.
Reply
I'm probably not going to need to clean PHP code anymore anyway.
Reply
There are two HTML cleaners. The old-fashioned one, cleanhtml.pl (which everyone else is talking about) is usually applied to perl strings in memory, returning a string result. It's used to clean entries, comments and other little things which are generally already in memory anyway, because they come from the database.
HTMLCleaner.pm, a more modern library, operates on streams and produces a stream. This is what the S2 print statement (from untrusted layers) is thrown through. This one's from the wcmtools repository, not livejournal, so it's BSD-licenced.
Reply
Reply
I didn't think Tidy's focus was XSS/Javascript removal. And looking at it again now, I'm even more certain of it. At least their docs/examples make no mention of either scripting or XSS.
Reply
Reply
Leave a comment