Fluid output · Question 11 of 12
A guestbook outputs entries with <f:format.raw>{entry.text}</f:format.raw>. Which corrections close the hole?
2 answers are correct. Hard
Show answer
Answer
- A Output {entry.text} without raw so that Fluid encodes it
- C If markup is wanted, use f:sanitize.html instead of f:format.raw
Explanation
The cause is the raw output. Without raw, Fluid encodes; with the sanitizer only allowed tags remain. A CSP only mitigates the consequences and does not fix the hole.