Serendipity Forums

Hi.

First of all, this is no offense agains the developer(s) responsible for the BBCode plugin. I just found it completely unusable in version 0.8 because of the changes to "which character is valid in an URL and which not". Therefore I decided to quit using BBCode and instead write plain HTML. Additionally, I wanted to stop using NL2BR and instead write <p> and <br/> tags manually.

I first thought about changing all of my 240 blog entries manually, but after the fifth I found out that this sucked. Therefore I wrote a little script to do this stuff automatically. If you want to do the same thing, have a look at BBCode Destroyer for Serendipity. It's a simple PHP script (public domain), and there's also a small english "how to use" manual.


Giving the community something back,

Tim.

Instead I would have preferred to tell us which BBCode cases to not work anymore. This should really get fixed at the proper place instead of getting rid of BBCode at all.

BBCode is a tough issue where XSS exploits easily happen. In latest 0.9 we added some characters (!, ~ and another one I forgot) to make it usable in more cases, and it sure will be part of a 0.8 maintenance release. We are very sorry that it caused inconveniences, but ! and ~ is not THAT common in URLs that BBCode is not usable at all.

Our main concern was to not have any security issue, but still having the possibility of a restricted BBCode.

A currently fixed plugin allowing more characters can be found here: SVN repository

Nevertheless thanks for your effort!

Regards,
Garvin

Well, IIRC, the three characters I found not working were "!", "~" and "?" (see my post in "Underline in URL converted to <u/>"). But I'm quite sure that these are not the only characters not working anymore. This was the first reason to stop using BBCode, because I didn't want to go through each of my entries to find possible problems.

I understand your security concerns, and I'm glad to hear that you're people who take security as serious as I do. I'm not really familiar with XSS, therefore I don't know how high the risk was or if it wouldn't be possible to just take out the "dangerous" characters instead of taking out all special characters and putting the "safe" ones in again version by version (shouldn't the valid characters be defined at RFC 2396?).

However, where I work (a German university), the use of "~" in URLs is quite common (see Apache's mod_userdir default configuration). I don't like it either, but I wouldn't say it's uncommon. And the bang ("!")... well, s9y itself creates links with this character in it (for example this blog entry), so it shouldn't refuse from linking to itself, should it.

I admit that "completely unusable" is a bit exaggerated, but these problems just made me think "aww, who knows which entries are affected, just throw the whole thing out". Also (and that's the second reason why I stopped using BBCode) I wanted to stop using NL2BR, so I decided to write all my HTML myself.

As I said in the first place, this is in no way meant to offend the BBCode (or NL2BR) plugin authors. When I first started to use s9y, I found the mass of input code plugins really cool (although you should clarify for the "wiki" plugin, which kind of wiki it resembles, because DokuWiki's syntax is quite different from MediaWiki, for example), and I definitely don't want to keep you from writing other plugins (hey, how about a TeX one ), but I just found out that I'm too much of an HTML fetishist to let some plugin create my code. I also don't intend to keep other people from using BBCode or NL2BR, but I decided to publish the script because it has been some hours of work and I thought that maybe others would find it useful.

Thanks for the quick fix of the BBCode plugin (although I don't need it anymore *g*). BTW, is "(" and ")" in the list of the allowed characters? Some excessive Wikipedia linkers (like I am) would possibly need it (even though MediaWiki itself urlencode()s the brackets).

And hey, thanks for visiting and commenting in my blog!

Scytale - thanks a lot for your detailed explanation, I can now much better understand your reasoning. And I'm sorry for letting you go through the hassle.

Actually I made real intense tests with BBCodes that were known to me. The security exploit about BBCode was sadly published without any of our developers being contacted first, so we had to act a bit in a hurry. Which also is the reason that none of us had to go through the RFC (shame on us) and instead used personal experience for assembling the valid characters.

Sadly it's much more reasonable to only include allowed characters instead of denying "bad" characters, as you never know if you got em all.

BTW, I think "(" and ")" is not allowed in URLs, only their encoded counterparts...

And about a TeX input plugin...well...uhm...freiwillige vor!

Regards,
Garvin

This isn't relevent to this topic, but if you want a Tex plugin you might look at the mimetex wrapper plugin...

It is not an input plugin, but it is pretty useable...