<html>
 <body>
  <div style="font-family: Verdana, Arial, Helvetica, Sans-Serif;">
   <table bgcolor="#f9f3c9" width="100%" cellpadding="8" style="border: 1px #c9c399 solid;">
    <tr>
     <td>
      This is an automatically generated e-mail. To reply, visit:
      <a href="http://git.reviewboard.kde.org/r/106083/">http://git.reviewboard.kde.org/r/106083/</a>
     </td>
    </tr>
   </table>
   <br />





<blockquote style="margin-left: 1em; border-left: 2px solid #d0d0d0; padding-left: 10px;">
 <p style="margin-top: 0;">On September 1st, 2012, 11:40 p.m., <b>Nikita Skovoroda</b> wrote:</p>
 <blockquote style="margin-left: 1em; border-left: 2px solid #d0d0d0; padding-left: 10px;">
  <pre style="white-space: pre-wrap; white-space: -moz-pre-wrap; white-space: -pre-wrap; white-space: -o-pre-wrap; word-wrap: break-word;">I just had a quick look on the youtube filter and it has some bugs.

Try this urls:
http://youtube.com/watch?v=somevideoid — does not get parsed?
http://www.youtube.com/html5 — does get parsed? error inside an iframe?
http://www.youtube.com/watch?v=%22%3E_scary_escaped_html_code_here — this is a security bug!</pre>
 </blockquote>







</blockquote>

<pre style="white-space: pre-wrap; white-space: -moz-pre-wrap; white-space: -pre-wrap; white-space: -o-pre-wrap; word-wrap: break-word;">I can inject any html/js inside the ktp-text-ui tab by constructing a youtube link like the third one, including loading of an external page or javascript.</pre>
<br />








<p>- Nikita</p>


<br />
<p>On August 19th, 2012, 10:29 a.m., Lasath Fernando wrote:</p>






<table bgcolor="#fefadf" width="100%" cellspacing="0" cellpadding="8" style="background-image: url('http://git.reviewboard.kde.org/media/rb/images/review_request_box_top_bg.png'); background-position: left top; background-repeat: repeat-x; border: 1px black solid;">
 <tr>
  <td>

<div>Review request for Telepathy.</div>
<div>By Lasath Fernando.</div>


<p style="color: grey;"><i>Updated Aug. 19, 2012, 10:29 a.m.</i></p>






<h1 style="color: #575012; font-size: 10pt; margin-top: 1.5em;">Description </h1>
 <table width="100%" bgcolor="#ffffff" cellspacing="0" cellpadding="10" style="border: 1px solid #b8b5a0">
 <tr>
  <td>
   <pre style="margin: 0; padding: 0; white-space: pre-wrap; white-space: -moz-pre-wrap; white-space: -pre-wrap; white-space: -o-pre-wrap; word-wrap: break-word;">Right, so here's a big fat review containing many many things, including all the remaining plugins and a few tweaks to Message.

As per usual, all the code is in my scratch repo: http://quickgit.kde.org/index.php?p=clones%2Fktp-text-ui%2Ffernando%2Fgsoc.git&a=summary

Now, I'm going to take a well earned nap.</pre>
  </td>
 </tr>
</table>


<h1 style="color: #575012; font-size: 10pt; margin-top: 1.5em;">Testing </h1>
<table width="100%" bgcolor="#ffffff" cellspacing="0" cellpadding="10" style="border: 1px solid #b8b5a0">
 <tr>
  <td>
   <pre style="margin: 0; padding: 0; white-space: pre-wrap; white-space: -moz-pre-wrap; white-space: -pre-wrap; white-space: -o-pre-wrap; word-wrap: break-word;">Wrote/passed/failed unit tests; talked to myself so much to the point I swear I have mild schizophrenia now. </pre>
  </td>
 </tr>
</table>




<h1 style="color: #575012; font-size: 10pt; margin-top: 1.5em;">Diffs</b> </h1>
<ul style="margin-left: 3em; padding-left: 0;">

 <li>filters/CMakeLists.txt <span style="color: grey">(ee7c23d)</span></li>

 <li>filters/bugzilla/CMakeLists.txt <span style="color: grey">(PRE-CREATION)</span></li>

 <li>filters/bugzilla/bugzilla-filter.h <span style="color: grey">(PRE-CREATION)</span></li>

 <li>filters/bugzilla/bugzilla-filter.cpp <span style="color: grey">(PRE-CREATION)</span></li>

 <li>filters/bugzilla/ktptextui_message_filter_bugzilla.desktop <span style="color: grey">(PRE-CREATION)</span></li>

 <li>filters/highlight/CMakeLists.txt <span style="color: grey">(PRE-CREATION)</span></li>

 <li>filters/highlight/highlight-filter.h <span style="color: grey">(PRE-CREATION)</span></li>

 <li>filters/highlight/highlight-filter.cpp <span style="color: grey">(PRE-CREATION)</span></li>

 <li>filters/highlight/ktptextui_message_filter_highlight.desktop <span style="color: grey">(PRE-CREATION)</span></li>

 <li>filters/latex/CMakeLists.txt <span style="color: grey">(PRE-CREATION)</span></li>

 <li>filters/latex/ktp_message_filter_latex_converter.sh <span style="color: grey">(PRE-CREATION)</span></li>

 <li>filters/latex/ktptextui_message_filter_latex.desktop <span style="color: grey">(PRE-CREATION)</span></li>

 <li>filters/latex/latex-filter.h <span style="color: grey">(PRE-CREATION)</span></li>

 <li>filters/latex/latex-filter.cpp <span style="color: grey">(PRE-CREATION)</span></li>

 <li>filters/pipes/CMakeLists.txt <span style="color: grey">(PRE-CREATION)</span></li>

 <li>filters/pipes/kcm_ktp_filter_config_pipes.desktop <span style="color: grey">(PRE-CREATION)</span></li>

 <li>filters/pipes/ktptextui_message_filter_pipes.desktop <span style="color: grey">(PRE-CREATION)</span></li>

 <li>filters/pipes/pipes-config.h <span style="color: grey">(PRE-CREATION)</span></li>

 <li>filters/pipes/pipes-config.cpp <span style="color: grey">(PRE-CREATION)</span></li>

 <li>filters/pipes/pipes-config.ui <span style="color: grey">(PRE-CREATION)</span></li>

 <li>filters/pipes/pipes-delegate.h <span style="color: grey">(PRE-CREATION)</span></li>

 <li>filters/pipes/pipes-delegate.cpp <span style="color: grey">(PRE-CREATION)</span></li>

 <li>filters/pipes/pipes-filter.h <span style="color: grey">(PRE-CREATION)</span></li>

 <li>filters/pipes/pipes-filter.cpp <span style="color: grey">(PRE-CREATION)</span></li>

 <li>filters/pipes/pipes-model.h <span style="color: grey">(PRE-CREATION)</span></li>

 <li>filters/pipes/pipes-model.cpp <span style="color: grey">(PRE-CREATION)</span></li>

 <li>filters/pipes/pipes-prefs.h <span style="color: grey">(PRE-CREATION)</span></li>

 <li>filters/pipes/pipes-prefs.cpp <span style="color: grey">(PRE-CREATION)</span></li>

 <li>filters/pipes/pipes-prefstest.h <span style="color: grey">(PRE-CREATION)</span></li>

 <li>filters/pipes/pipes-prefstest.cpp <span style="color: grey">(PRE-CREATION)</span></li>

 <li>filters/substitution/CMakeLists.txt <span style="color: grey">(PRE-CREATION)</span></li>

 <li>filters/substitution/kcm_ktp_filter_config_substitution.desktop <span style="color: grey">(PRE-CREATION)</span></li>

 <li>filters/substitution/ktptextui_message_filter_substitution.desktop <span style="color: grey">(PRE-CREATION)</span></li>

 <li>filters/substitution/substitution-config.h <span style="color: grey">(PRE-CREATION)</span></li>

 <li>filters/substitution/substitution-config.cpp <span style="color: grey">(PRE-CREATION)</span></li>

 <li>filters/substitution/substitution-config.ui <span style="color: grey">(PRE-CREATION)</span></li>

 <li>filters/substitution/substitution-filter.h <span style="color: grey">(PRE-CREATION)</span></li>

 <li>filters/substitution/substitution-filter.cpp <span style="color: grey">(PRE-CREATION)</span></li>

 <li>filters/substitution/substitution-prefs.h <span style="color: grey">(PRE-CREATION)</span></li>

 <li>filters/substitution/substitution-prefs.cpp <span style="color: grey">(PRE-CREATION)</span></li>

 <li>filters/youtube/CMakeLists.txt <span style="color: grey">(PRE-CREATION)</span></li>

 <li>filters/youtube/ktptextui_message_filter_youtube.desktop <span style="color: grey">(PRE-CREATION)</span></li>

 <li>filters/youtube/youtube-filter.h <span style="color: grey">(PRE-CREATION)</span></li>

 <li>filters/youtube/youtube-filter.cpp <span style="color: grey">(PRE-CREATION)</span></li>

 <li>lib/abstract-message-filter.h <span style="color: grey">(7b60d48)</span></li>

 <li>lib/abstract-message-filter.cpp <span style="color: grey">(2a3a897)</span></li>

 <li>lib/message.h <span style="color: grey">(ef9530b)</span></li>

 <li>lib/message.cpp <span style="color: grey">(6db648e)</span></li>

 <li>tests/message-processor-basic-tests.h <span style="color: grey">(7dc99e4)</span></li>

 <li>tests/message-processor-basic-tests.cpp <span style="color: grey">(8546605)</span></li>

</ul>

<p><a href="http://git.reviewboard.kde.org/r/106083/diff/" style="margin-left: 3em;">View Diff</a></p>




  </td>
 </tr>
</table>








  </div>
 </body>
</html>