Differential D7329
Disallow <! in <script> Authored by vrana on Oct 16 2013, 3:49 PM. Tags None Referenced Files
Subscribers
Details
HTML5 has this crazy script escaping states:
https://communities.coverity.com/blogs/security/2012/11/16/did-i-do-that-html-5-js-escapers-3 Perhaps <! is too aggressive but I didn't spend much time searching for a more fine grained expression. Searched for renderInlineScript().
Diff Detail
Event TimelineComment Actions Thanks! Do you think we should also force json_encode() to escape !? I can't imagine it causing problems, so we could probably wait until it does... Comment Actions I think this is fine. It should be dangerous only inside <script> and we replace all < before sending it there. |