Do not allow the about: URI scheme

Some browsers interpret about: URIs like a limited version of data:
URIs.  In particular, some versions of Internet Explorer interpret
arbitrary HTML content in about: URIs.

diff --git a/IkiWiki/Plugin/htmlscrubber.pm b/IkiWiki/Plugin/htmlscrubber.pm
index 634674b9c91b858f1e72c0fd6b949f18046ef183..e02a8591ef2eac17d9d34eba4031bcdb7ce6b3ab 100644 (file)
--- a/IkiWiki/Plugin/htmlscrubber.pm
+++ b/IkiWiki/Plugin/htmlscrubber.pm
@@ -30,7 +30,7 @@ sub scrubber { #{{{
                "sip", "sips", "snmp", "tel", "urn", "wais", "xmpp",
                "z39.50r", "z39.50s",
                # Selected unofficial schemes
-               "about", "aim", "callto", "cvs", "ed2k", "feed", "fish", "gg",
+               "aim", "callto", "cvs", "ed2k", "feed", "fish", "gg",
                "irc", "ircs", "lastfm", "ldaps", "magnet", "mms",
                "msnim", "notes", "rsync", "secondlife", "skype", "ssh",
                "sftp", "sms", "steam", "webcal", "ymsgr",

diff --git a/debian/changelog b/debian/changelog
index e772fb8979a3ea705ca3a09decaf0c3d4b0956e1..35dd1b6f181507c99b18ed8a312b59947d3d98f9 100644 (file)
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,12 @@
+ikiwiki (2.32.3) UNRELEASED; urgency=low
+
+  * Do not allow the about: URI scheme; some browsers interpret about:
+    URIs like a limited version of data: URIs.  In particular, some
+    versions of Internet Explorer interpret arbitrary HTML content in
+    about: URIs.
+
+ -- Josh Triplett <josh@freedesktop.org>  Sun, 10 Feb 2008 13:18:58 -0800
+
 ikiwiki (2.31.2) unstable; urgency=high
 
   * The security fix in the last release had buggy handling of data:image,