InformAction Forums

I'm getting the XSS warning when passing this parameter to any site where scripts are allowed:

q=%0A%26lt%3Bscript

For example:
http://www.kernel.org/?q=%0A%26lt%3Bscript

The parameter decodes as: [newline]<script

Is this a bug? How could that parameter be considered a XSS risk? (The initial newline seems to trigger it - without that it's not a problem.)

I think newlines can be used to tamper with HTTP headers in some cases, so I doubt it's a bug. Giorgio would know more.