From: Josh Triplett <josh@freedesktop.org>
Date: Sun, 10 Feb 2008 21:23:28 +0000 (-0800)
Subject: Do not allow the about: URI scheme
X-Git-Url: https://sipb.mit.edu/gitweb.cgi/ikiwiki.git/commitdiff_plain/a7be7bdf56b60a08a7ae23a17e20d2bad4cc2971

Do not allow the about: URI scheme

Some browsers interpret about: URIs like a limited version of data:
URIs.  In particular, some versions of Internet Explorer interpret
arbitrary HTML content in about: URIs.
---

diff --git a/IkiWiki/Plugin/htmlscrubber.pm b/IkiWiki/Plugin/htmlscrubber.pm
index 634674b9c..e02a8591e 100644
--- a/IkiWiki/Plugin/htmlscrubber.pm
+++ b/IkiWiki/Plugin/htmlscrubber.pm
@@ -30,7 +30,7 @@ sub scrubber { #{{{
 		"sip", "sips", "snmp", "tel", "urn", "wais", "xmpp",
 		"z39.50r", "z39.50s",
 		# Selected unofficial schemes
-		"about", "aim", "callto", "cvs", "ed2k", "feed", "fish", "gg",
+		"aim", "callto", "cvs", "ed2k", "feed", "fish", "gg",
 		"irc", "ircs", "lastfm", "ldaps", "magnet", "mms",
 		"msnim", "notes", "rsync", "secondlife", "skype", "ssh",
 		"sftp", "sms", "steam", "webcal", "ymsgr",
diff --git a/debian/changelog b/debian/changelog
index dc55cdd88..765cdb9e0 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -6,8 +6,12 @@ ikiwiki (2.40) UNRELEASED; urgency=low
     optional '!' prefix even with prefix_directives off, and use that in
     the underlay to support either setting of prefix_directives.  Add NEWS
     entry with migration information.
+  * Do not allow the about: URI scheme; some browsers interpret about:
+    URIs like a limited version of data: URIs.  In particular, some
+    versions of Internet Explorer interpret arbitrary HTML content in
+    about: URIs.
 
- -- Josh Triplett <josh@freedesktop.org>  Sat, 09 Feb 2008 23:01:19 -0800
+ -- Josh Triplett <josh@freedesktop.org>  Sun, 10 Feb 2008 13:18:58 -0800
 
 ikiwiki (2.31.2) unstable; urgency=high