TYPO3 Core

No objections.

The uploaded patch is the version used in trunk. So we have the same security for RemoveXSS in both versions (4.2 and trunk)

Ernesto, please add to your reviews for beta2

Steffen, will do.

First note is that I would love to see some unit tests for the most common XSS cases that are being handled by this script, so that we can make sure it doesn't break if we change something. The function is pretty long and tedious to test or consider all potential exploits.

Ernesto, i will start with unit tests in trunk.
I did a page where i compared the "new" file (this) against the old (4.2 current) here:
http://www.sk-typo3.de/index.php?id=370

I also installed a testscript here:
http://www.sk-typo3.de/RemoveXSS.376.0.html

added some unit tests in #21314 - will commit it to trunk in some minutes

Steffen, thanks a lot for the work. I haven't reviewed it but I assume it is already ok. Have you commited it? "Some minutes" have already passed. :)

it's committed yesterday to trunk (unit tests). This patch is for 4_2 and should go to 4.2.10 so we have the same file in both versions for better maintainance (i promised Larsto tke care)

Ok Steffen, thanks! I will review this and we will commit this right before release of 4.2.10 (meaning tomorrow morning).

Commited to TYPO3_4-2, rev.6228

reopened to make it public