Ticket #5663 (new defect)

Opened 10 months ago

URL sanitization is too restrictive

Reported by: nbachiyski Assigned to: anonymous
Priority: normal Milestone: 2.9
Component: General Version:
Severity: normal Keywords:
Cc:

Description

Url sanitization is too strict, it allows only character from the following class: [^a-z0-9-~+_.?#=!&;,/:%@]

A URL can contain every possible character, so we shouldn't strip them, but just escape accordingly.