Do not allow the about: URI scheme

Some browsers interpret about: URIs like a limited version of data:
URIs.  In particular, some versions of Internet Explorer interpret
arbitrary HTML content in about: URIs.

diff --git a/IkiWiki/Plugin/htmlscrubber.pm b/IkiWiki/Plugin/htmlscrubber.pm
index 634674b9c91b858f1e72c0fd6b949f18046ef183..e02a8591ef2eac17d9d34eba4031bcdb7ce6b3ab 100644 (file)
--- a/IkiWiki/Plugin/htmlscrubber.pm
+++ b/IkiWiki/Plugin/htmlscrubber.pm
@@ -30,7 +30,7 @@ sub scrubber { #{{{
                "sip", "sips", "snmp", "tel", "urn", "wais", "xmpp",
                "z39.50r", "z39.50s",
                # Selected unofficial schemes
-               "about", "aim", "callto", "cvs", "ed2k", "feed", "fish", "gg",
+               "aim", "callto", "cvs", "ed2k", "feed", "fish", "gg",
                "irc", "ircs", "lastfm", "ldaps", "magnet", "mms",
                "msnim", "notes", "rsync", "secondlife", "skype", "ssh",
                "sftp", "sms", "steam", "webcal", "ymsgr",

diff --git a/debian/changelog b/debian/changelog
index dc55cdd8865bedf324b6dcc1339be3d51b7b2341..765cdb9e0b2f82ff452e4ae1102102c7a31bef08 100644 (file)
--- a/debian/changelog
+++ b/debian/changelog
@@ -6,8 +6,12 @@ ikiwiki (2.40) UNRELEASED; urgency=low
     optional '!' prefix even with prefix_directives off, and use that in
     the underlay to support either setting of prefix_directives.  Add NEWS
     entry with migration information.
+  * Do not allow the about: URI scheme; some browsers interpret about:
+    URIs like a limited version of data: URIs.  In particular, some
+    versions of Internet Explorer interpret arbitrary HTML content in
+    about: URIs.
 
- -- Josh Triplett <josh@freedesktop.org>  Sat, 09 Feb 2008 23:01:19 -0800
+ -- Josh Triplett <josh@freedesktop.org>  Sun, 10 Feb 2008 13:18:58 -0800
 
 ikiwiki (2.31.2) unstable; urgency=high