I disclosed the following advisory about a XSS vulnerability of RedCloth (Textile library for Ruby). http://co3k.org/blog/redcloth-unfixed-xss-en You shouldn't use RedCloth to parse user inputted contents and output the parsed string (except that you allow your user to write arbitrary JavaScript code on your site) because it contains unfixed XSS vulnerability for 9 years, and it be also disclosed for 2 years. Unfortunately, we may not expect fix the vulnerability by the current developer because he announced that "unable to keep fixing bugs or work on the next major release". If you want to continue to use RedCloth for such contents, you should patch for the problem yourself, consider contributing to RedCloth, or otherwise. PoC === ``` require 'redcloth' print RedCloth.new('["clickme":javascript:alert(%27XSS%27)]', [:filter_html, :filter_styles, :filter_classes, :filter_ids]).to_html # Result: # <p><a href="javascript:alert(%27XSS%27)">clickme</a></p> ``` Timeline ======== * Feb. 24, 2012 : I reported the problem to a developer (by sending e-mail) * Feb. 29, 2012 : A developer discloses the issue in this ticket: http://jgarber.lighthouseapp.com/projects/13054-redcloth/tickets/243-xss * ... * Sep. 24, 2014 : Announced "RedCloth needs new maintainers" to take over RedCloth by a developer: https://github.com/jgarber/redcloth/commit/b24f03db023d1653d60dd33b28e09317cd77c6a0