recaptime.dev / phorge
@recaptime-dev's working patches + fork for Phorge, a community fork of Phabricator. (Upstream dev and stable branches are at upstream/main and upstream/stable respectively.) hq.recaptime.dev/wiki/Phorge
phorge phabricator
Star
Fork 0
Watch

Disallow <! in <script> master

Summary: HTML5 has this crazy script escaping states: - Script data escaped dash dash state - Script data double escaped state https://communities.coverity.com/blogs/security/2012/11/16/did-i-do-that-html-5-js-escapers-3 Perhaps `<!` is too aggressive but I didn't spend much time searching for a more fine grained expression. Test Plan: Searched for `renderInlineScript()`. Reviewers: epriestley Reviewed By: epriestley CC: Korvin, epriestley, aran Differential Revision: https://secure.phabricator.com/D7329

Author Jakub Vrana Date Commit 29391a65 Parent d34143c7
+6
3 changed files