From: Joey Hess <joey@kodama.kitenet.net>
Date: Sun, 10 Feb 2008 23:50:18 +0000 (-0500)
Subject: Do not allow the about: URI scheme
X-Git-Tag: 2.32.3~11
X-Git-Url: http://git.tremily.us/?a=commitdiff_plain;h=02d28f95e78a03935c09e74a279fde125160e2e7;p=ikiwiki.git

Do not allow the about: URI scheme

Some browsers interpret about: URIs like a limited version of data:
URIs.  In particular, some versions of Internet Explorer interpret
arbitrary HTML content in about: URIs.
---

diff --git a/IkiWiki/Plugin/htmlscrubber.pm b/IkiWiki/Plugin/htmlscrubber.pm
index 634674b9c..e02a8591e 100644
--- a/IkiWiki/Plugin/htmlscrubber.pm
+++ b/IkiWiki/Plugin/htmlscrubber.pm
@@ -30,7 +30,7 @@ sub scrubber { #{{{
 		"sip", "sips", "snmp", "tel", "urn", "wais", "xmpp",
 		"z39.50r", "z39.50s",
 		# Selected unofficial schemes
-		"about", "aim", "callto", "cvs", "ed2k", "feed", "fish", "gg",
+		"aim", "callto", "cvs", "ed2k", "feed", "fish", "gg",
 		"irc", "ircs", "lastfm", "ldaps", "magnet", "mms",
 		"msnim", "notes", "rsync", "secondlife", "skype", "ssh",
 		"sftp", "sms", "steam", "webcal", "ymsgr",
diff --git a/debian/changelog b/debian/changelog
index e772fb897..35dd1b6f1 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,12 @@
+ikiwiki (2.32.3) UNRELEASED; urgency=low
+
+  * Do not allow the about: URI scheme; some browsers interpret about:
+    URIs like a limited version of data: URIs.  In particular, some
+    versions of Internet Explorer interpret arbitrary HTML content in
+    about: URIs.
+
+ -- Josh Triplett <josh@freedesktop.org>  Sun, 10 Feb 2008 13:18:58 -0800
+
 ikiwiki (2.31.2) unstable; urgency=high
 
   * The security fix in the last release had buggy handling of data:image,