On Mon, Oct 12, 2009 at 12:18 PM, Matthew Toseland
<toad at amphibian.dyndns.org> wrote:
> 2fe658bcd35a9b96a04792df22059559bc7c83a7
> - okay, but we really should use <?xml..> for charset detection, and fail if 
> both are specified and the meta charset is different to the xml charset
> - also we should enforce it being the first tag
> - will standalone ever be specified for XHTML??
> - are there any issues with treating code as XML versus as HTML? IIRC there 
> are, depending on browser, MIME type etc... are any exploitable?

All good points.  Out of scope for this patch, though; I'm just trying
to make it do what it was already supposed to be doing, but correctly.

I may go write a proper XHTML filter; if so, it will definitely handle those.

> f031cf91ca58399b45ce15011c05266450b85602
> - should do if(logMINOR) log...

Added in 203a74.

Evan Daniel

Reply via email to