-
☆ A M B ☆
- 476 Posts
Details about the MODX/server/plugin setup:
- We're running MODX 2.3.5-pl
- LAMP server (don't have the specifics of the server, but it was one recently setup...if more information is needed, can definitely get it).
- SimpleSearch 1.9.2-pl
If doing a search for HTML strings, like the following:
"><svg%2Fonload%3Dprompt%28%2Fxssposed%2F%29>
We get this result back (I blurred out the company's name on purpose):
http://files.smashstack.com/KtWg/2KKS2L4r
Should the search results be returning this?
Precision Web Development ... SmashStack.com
-
☆ A M B ☆
- 24,524 Posts
It looks like SimpleSearch is actually stripping the HTML tag, and searching on the "> characters and finding results. There's probably an img tag on that page. What else is it supposed to do? "> is not in any way dangerous by itself.
-
☆ A M B ☆
- 24,524 Posts
SimpleSearch uses the MODX sanitize() function to clean up the search terms, and strips out MODX tags on its own. I don't think you're going to be able to do anything except return search results on whatever is left.
[ed. note: sottwell last edited this post 11 years ago.]
-
☆ A M B ☆
- 476 Posts
Quote from: sottwell at Sep 24, 2015, 04:06 PMIt looks like SimpleSearch is actually stripping the HTML tag, and searching on the "> characters and finding results. There's probably an img tag on that page. What else is it supposed to do? "> is not in any way dangerous by itself.
Hey Susan, thanks for the response. You're right. The client is using the TinyMCE RTE to embed images in the Resource Content area which is included in the search results, the lesser than symbol in the HTML
http://files.smashstack.com/OFml/3uLQEie6
That's probably it.
Thanks!
Precision Web Development ... SmashStack.com
