Isn't that a HUGE security hole?

It's obvious to me that it isn't, but since it isn't obvious to you, perhaps you'd like to elaborate.

And anyway, how would replacing newlines with <p> tags mitigate this "security hole"?

"What the PM engine receives is what the user typed into the box. What is stored in the db is what the user typed into the box."

I'm not sure I understand how storing user input in the database creates a security issue. If it's code that could run, someone would have to grab that node and .. execute it. The Everything2 engine just stores the user input, then regurgitates it when a node is displayed. The content is never executed by the engine, or by the browser.

Do you have a proof of concept node that exploits this?

Theoretically you could inject XSS code into the user's page or execute other JS exploits.

You could also damage the display of framing pages with corrupted HTML. (more a nuisance)

But the posts are filtered and only approved markup is allowed.

Our new pmdev hasn't even read the user docu below each post form.

-> Markup in the Monastery -> Perl Monks Approved HTML tags

Cheers Rolf
_{(addicted to the Perl Programming Language :)
Wikisyntax for the Monastery FootballPerl is like chess, only without the dice}

session riding, https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html

Why don’t you explain how it is a huge security hole?

Don't you think answering questions with questions is a rather old troll trick?

;P

(Update: Meta sarcasm)

Cheers Rolf
_{(addicted to the Perl Programming Language :)
Wikisyntax for the Monastery FootballPerl is like chess, only without the dice}