Thread

Assuming ExpressionEngine is running on http://www.domain.com, if you invent a fictitious file and parameters, like:

<a href="http://www.domain.com/SameCustomPageXSS.pl?testhere&#91removed&#93alert&#40700&#41&#91removed&#93">http://www.domain.com/SameCustomPageXSS.pl?testhere[removed]alert(700);[removed&#93</a>;

ExpressionEngine will return the error:

Disallowed Key Characterstesthere[removed]alert(700);[removed]

And in some browsers, like Firefox, will execute the script.

How can we prevent this?

If you are running EE v1, you should upgrade to the latest version. There were quite a few security fixes for XSS exploits applied. If you are referring to the most recent version of EE 1.x still having an XSS vulnerability, then you should file a bug report. I don’t know if Ellis Lab would release another security fix for the 1.7.x branch, but who knows. If they don’t/won’t, then we should get the vulnerability fully documented, and maybe one of the 3rd party devs can hack a fix together.

If you are referring to EE 2.x, you should file a bug report and have EL fix this puppy.

-j