Fixed issue with null bytes in the default xss filter. Fixes #2669

kohana · Mar 6, 2010 · da26200 · da26200
1 parent aa7a353
commit da26200
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/system/libraries/Input.php b/system/libraries/Input.php
@@ -465,7 +465,7 @@ protected function xss_filter_default($data)
 		{
 			// Remove really unwanted tags
 			$old_data = $data;
-			$data = preg_replace('#</*(?:applet|b(?:ase|gsound|link)|embed|frame(?:set)?|i(?:frame|layer)|l(?:ayer|ink)|meta|object|s(?:cript|tyle)|title|xml)[^>]*+>#i', '', $data);
+			$data = preg_replace('#</*[\x00-\x20]*(?:applet|b(?:ase|gsound|link)|embed|frame(?:set)?|i(?:frame|layer)|l(?:ayer|ink)|meta|object|s(?:cript|tyle)|title|xml)[^>]*+>#i', '', $data);
 		}
 		while ($old_data !== $data);