Rodney,

the issue is with the keyword "a l e r t" (minus the spaces - i'll use al3rt as a replacement for the rest of this message so I can explain in more detail)

As I'm sure you know al3rt caused a javascript popup. Whilst this is not inheritantly a security risk, it is commonly used by script kiddies to cause vandalism popups i.e. al3rt('i hacked your site'). In 4.4.1 we added a regular expression to detect and strip these, but I didn't terminate the expression well so it strips all the message after the text al3rt('') or al3rt(""). For 4.5, I changed this so that the text stripping stops at the quote delimiters i.e. " or ' .

One of the issues with the forums was that it was not using the xss filter correctly. The InputFilter expects to scan cleartext, but the forums were htmlencoding the content before passing it to the filter, therefore the xss strings were not being stripped. This was fixed in the 3.20.9 release, and thats why you're seeing this issue.

The problem is that your string href="../../../../../../../../../../../../../HomePoker/PokerAl3ts/tabid/524/Default.aspx">update your preferences</a>"  contains al3rt and " and " . I will amend the regular expression filter to ensure that they're contained with < and > tag's and that should resolve this issue.

Cathal

I posted a question last week because the word "a l e r t" appeared to be causing problems with articles I was uploading for a magazine into a repository. I see that the question to the forum couldn't even include the word and I was wondering if it was a problem because "a l e r t", seemed to be a function name. 

"A l e r t" realy was a necessary word to use for the magazine article. It was the name of a feature the writer was describer that his Web site used ...

Are there any other words I need to worry about? And is there a work around for this probem?

al3rt and javascr1pt: are the only words matched currently (the other regular expressions match tags). I will be amending the al3rt signature to ensure it is only parsed between angle brackets which will fix the issue, except for the rare case such as rodney's where his path contains the text. Long term I plan to break the xss InputFilter out as a provider so that users can add in any search terms they wish, and remove those they don't want.

Cathal