Andy Staudacher c453c0ef82 Simplifying SafeString a bit: From a XSS HTML security point of view, treat clean() and purify() the same. ...

No longer run a safe HTML string through the HTML purifier (since it's already marked as safe).

This also addresses the issue of calling purify() when no purifier is installed. In that case, we'd run clean() on a clean string (double HTML encoding).

If this approach doesn't work out, we can still modify the fallback code of purify() to check if the string is already clean before calling clean() instead of purify().

2009-09-04 10:11:42 -07:00

5.5 KiB

Raw Blame History

View Raw