QA (public) » openQA Project (public)

Took a quick look at this since i wrote the Markdown conversion code. And i'm afraid it is not as easy as it looks at first. We are currently using a regex from Regexp::Common to detect URLs in OpenQA::Markdown. That regex will need to be replaced with one that includes fragments. This is a serious XSS/HTML injection attack target, so the regex will need to be selected very carefully. And new tests should cover as many edge cases as possible.

This is the line you want to modify and the new tests go here.

This line produces the same error as well. Is there a reason to leave it out?

btw, with a quick look, the current implementations both in Markdown.pm and Utils.pm both seem to be already open to injection attacks. So I think it makes sense to change both.