BukkitDev Formatting Options and Security

Discussion in 'Bukkit News' started by EvilSeph, Jun 9, 2012.

Thread Status:
Not open for further replies.
  1. Offline

    EvilSeph Retired Staff

    A couple weeks ago many of you brought up an issue regarding the loss of formatting options on BukkitDev, our Minecraft plugins download service powered by CurseForge. After further investigation, it turns out several formats were disabled due to the security risk they posed to the site - a severe XSS vulnerability was discovered in the Markdown parser as well as a potential security risk in the Safe HTML parser.

    As a security precaution the affected parsers were disabled from further usage and new projects were forced to use a more secure alternative. Unfortunately, due to a bug in the system, every project was accidentally set to the WikiCreole format and developers found themselves unable to switch their projects back to the formatting they previously used. This was a bug and completely unintended.

    Having conducted an extensive investigation into the vulnerabilities we discovered and concluding that we have addressed them accordingly, I'm happy to announce that Safe HTML is back (along with the ability to use it within Markdown too).

    The new and improved Safe HTML (and Markdown) supports the following tags:
    a, abbr, b, big, blockquote, br, caption, code, dd,
    del, dl, dt, em, h1, h2, h3, h4, h5, h6, hr, i,
    img, li, ol, p, pre, s, small, strike, strong, sub,
    sup, table, tbody, td, tfoot, th, thead, tr, ul

    And attributes:
    alt, colspan, href, rowspan, src, title

    If you have any tags and attributes you'd like to see supported, please post a comment on the BukkitDev article here and we'll take your input into consideration.
     
    dark_hunter and Technius like this.
  2. That's nice! Any way you guys could include spoiler tags in WikiCreole?
     
  3. We know you don't goof us to troll us, you are human!
     
  4. As far as I know there isn't actually a spoiler built into WikiCreole. However, I would like to see this too so I'll do some digging and see if it's possible at all :)
     
  5. My plugin that used Safe HTML is intact, aside from the missing <u> which I've reported.
     
  6. I with they had the formatting options on BukkitDev that are on the forums.
    Code:
    [code]
    [URL]
    [IMG]
    
    Instead of annoying {{'s.

    tl;dr
    Long live BBCode!
     
  7. :O let's make the forums support wikicreole :D
     
Thread Status:
Not open for further replies.

Share This Page