diff options
Diffstat (limited to 'scripts')
| -rw-r--r-- | scripts/code-style.pl | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/scripts/code-style.pl b/scripts/code-style.pl index cc1f159e7..f7d773e54 100644 --- a/scripts/code-style.pl +++ b/scripts/code-style.pl @@ -69,6 +69,16 @@ while (<>) { elsif (/<br>/i) { $msg = "'<br>' -> '<br />'"; } + elsif (/HTTP_REFERER/i) { + $msg = "the use of HTTP_REFERER is prone to XSS exploits; use referer_uri() instead"; + } + elsif (/QUERY_STRING/i) { + $msg = "the use of HTTP_REFERER is prone to XSS exploits; use referer_uri() instead"; + } + elsif (/REQUEST_URI/i) { + $msg = "the use of HTTP_REFERER is prone to XSS exploits and does not work on IIS; use request_uri() instead"; + } + # XHTML compatibility mode suggests a blank before / # i.e. <br /> elsif (/<[a-z][^>]*[^ >]\/>/i) { |