TangoBB/TangoBB — pull request #6 by Jacques1 (2014-02-21 06:10:04+00:00)
Title: Rewrite of BBCode parser

- fixed XSS vulnerabilty caused by unescaped quoted texts
- fixed XSS vulnerability caused by unescaped quote characters
- fixed XSS vulnerabilities caused by insecure contexts (style, href and src attribute)
- prevent invalid HTML markup (only allow
elements in lists, prevent stray tags, don't allow plain "&" characters, always set all required attributes)
- set nofollow attribute for links
- replaced duplicate code