XSS in BBCode

[GeonoTRON2000]

The following produces successful XSS within BBCode in FluxBB 1.5.11:

[b=[img]https://[/b][url]onerror=alert(1)//[/url][b=[/img]a[/b]

I have not verified whether it works in this fork, but this is different from all the existing XSS issues that have been filed so I assume it does.

[MioVisman]

Thank you! A quick fix that doesn't require much expense.
P.S. GitHub has become too smart, it decides whether to close or not.

[GeonoTRON2000]

Parser rewrite is ready in GeonoTRON2000/fluxbb#10, if you'd like to pick it up I can make a PR in this repo.

[MioVisman]

There are changes in the parser here for various FluxBB modifications, so a simple replacement for your parser cannot be made.

[GeonoTRON2000]

Yeah painful, unfortunate.