symphonycms/xssfilter — pull request #4 by allen (2012-11-19 05:03:59+00:00)
Title: Added `feed` and `data` to the filter list

There are two known types of XSS attacks that the xssfilter extension does not account for:

`data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==`

`feed:data:text/html,%3csvg%20onload=alert%281%29%3e` *(Firefox only)*

These can be easily prevented by adding the `data` and `feed` protocol to the exclusion list.