Skip to content

Fix slashes as separators. - #269

Open
hensleysecurity wants to merge 1 commit into
leizongmin:masterfrom
hensleysecurity:fix-slashes-as-separators
Open

Fix slashes as separators.#269
hensleysecurity wants to merge 1 commit into
leizongmin:masterfrom
hensleysecurity:fix-slashes-as-separators

Conversation

@hensleysecurity

@hensleysecurity hensleysecurity commented Dec 28, 2022

Copy link
Copy Markdown

This should resolve #268.

@hensleysecurity
hensleysecurity force-pushed the fix-slashes-as-separators branch 4 times, most recently from 843beed to b532e57 Compare December 29, 2022 06:33
@hensleysecurity
hensleysecurity force-pushed the fix-slashes-as-separators branch from b532e57 to 10bacdc Compare December 29, 2022 06:35
@leizongmin

leizongmin commented Mar 23, 2023 •
edited
Loading

Copy link
Copy Markdown
Owner

The mainstream html parser will parse it into the following results:

[
  {
    "tag": "img",
    "attrs": {
      "width": "100/height=200/src=\"#\"/"
    }
  }
]

image

I think treating the slash as a delimiter might present a potential problem.

@hensleysecurity

hensleysecurity commented Mar 24, 2023

Copy link
Copy Markdown
Author

@leizongmin I am not able to replicate your result. It looks like maybe you wrapped the slashes inside quotes in your source HTML. Please try the following example instead:

<html>
  <body>
    <img/width="100"/height="200"/src="#"/>
  </body>
</html>

I see the behavior I would expect when I try this in Chrome:
console

And Firefox as well:
console2

Also please see the HTML spec:

When the prescan a byte stream to determine its encoding algorithm says to get an attribute, it means doing this:

If the byte at position is one of 0x09 (HT), 0x0A (LF), 0x0C (FF), 0x0D (CR), 0x20 (SP), or 0x2F (/) then advance position to the next byte and redo this step.

In other words, when getting HTML attributes, a properly implemented web browser will treat a / the same as a whitespace character, so I think it's very important that this project's code does the same thing.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

whiteList fails when using slashes to separate tag attributes (PR included)

2 participants

@hensleysecurity @leizongmin