response

[git.ikiwiki.info.git] / doc / security.mdwn

diff --git a/doc/security.mdwn b/doc/security.mdwn
index 200ae29e22831abecec7dfbc2da9c1b07ab07bbf..34a0052397fa857552051fc7e06cef84a1ccab01 100644 (file)
--- a/doc/security.mdwn
+++ b/doc/security.mdwn
@@ -162,10 +162,11 @@ closed though.
 
 ## HTML::Template security
 
 
 ## HTML::Template security
 

-If the [[plugins/template]] plugin is enabled, users can modify templates
-like any other part of the wiki. This assumes that HTML::Template is secure
+If the [[plugins/template]] plugin is enabled, all users can modify templates
+like any other part of the wiki. Some trusted users can modify templates
+without it too. This assumes that HTML::Template is secure

 when used with untrusted/malicious templates. (Note that includes are not
 when used with untrusted/malicious templates. (Note that includes are not

-allowed, so that's not a problem.)
+allowed.)

 
 ----
 
 
 ----
 


@@ -426,4 +427,16 @@ bypassed and used to read arbitrary files. This was fixed by
 enabling TeX configuration options that disallow unsafe TeX commands.
 The fix was released on 30 Aug 2009 in version 3.1415926, and was
 backported to stable in version 2.53.4. If you use the teximg plugin,
 enabling TeX configuration options that disallow unsafe TeX commands.
 The fix was released on 30 Aug 2009 in version 3.1415926, and was
 backported to stable in version 2.53.4. If you use the teximg plugin,

-I recommend upgrading.
+I recommend upgrading. ([[!cve CVE-2009-2944]])
+
+## javascript insertion via svg uris
+
+Ivan Shmakov pointed out that the htmlscrubber allowed `data:image/*` urls,
+including `data:image/svg+xml`. But svg can contain javascript, so that is
+unsafe.
+
+This hole was discovered on 12 March 2010 and fixed the same day
+with the release of ikiwiki 3.20100312.
+A fix was also backported to Debian etch, as version 2.53.5. I recommend
+upgrading to one of these versions if your wiki can be edited by third
+parties.