Page MenuHomePhabricator

Disallow <! in <script>
ClosedPublic

Authored by vrana on Oct 16 2013, 3:49 PM.
Tags
None
Referenced Files
F18820907: D7329.id.diff
Wed, Oct 22, 5:54 PM
F18770985: D7329.diff
Wed, Oct 8, 4:42 PM
F18766516: D7329.id16504.diff
Tue, Oct 7, 5:03 PM
F18749893: D7329.id16504.diff
Sat, Oct 4, 5:32 AM
F18545306: D7329.id16504.diff
Sep 8 2025, 1:45 AM
F18516263: D7329.id16504.diff
Sep 5 2025, 12:23 PM
F18514577: D7329.id16503.diff
Sep 5 2025, 10:38 AM
F18512612: D7329.id.diff
Sep 5 2025, 8:19 AM

Details

Reviewers
epriestley
Commits
Restricted Diffusion Commit
rP29391a658e77: Disallow <! in <script>
Summary

HTML5 has this crazy script escaping states:

  • Script data escaped dash dash state
  • Script data double escaped state

https://communities.coverity.com/blogs/security/2012/11/16/did-i-do-that-html-5-js-escapers-3

Perhaps <! is too aggressive but I didn't spend much time searching for a more fine grained expression.

Test Plan

Searched for renderInlineScript().

Diff Detail

Lint
Lint Skipped
Unit
Tests Skipped

Event Timeline

Thanks!

Do you think we should also force json_encode() to escape !? I can't imagine it causing problems, so we could probably wait until it does...

I think this is fine. It should be dangerous only inside <script> and we replace all < before sending it there.