From 29391a658e772e4cdaad68cbbed748981cda0ddd Mon Sep 17 00:00:00 2001
From: Jakub Vrana <jakub@vrana.cz>
Date: Wed, 16 Oct 2013 09:28:37 -0700
Subject: [PATCH] Disallow <! in <script>

Summary:
HTML5 has this crazy script escaping states:

- Script data escaped dash dash state
- Script data double escaped state

https://communities.coverity.com/blogs/security/2012/11/16/did-i-do-that-html-5-js-escapers-3

Perhaps `<!` is too aggressive but I didn't spend much time searching for a more fine grained expression.

Test Plan: Searched for `renderInlineScript()`.

Reviewers: epriestley

Reviewed By: epriestley

CC: Korvin, epriestley, aran

Differential Revision: https://secure.phabricator.com/D7329
---
 .../controller/DifferentialRevisionViewController.php          | 1 +
 .../view/DifferentialRevisionUpdateHistoryView.php             | 2 ++
 src/infrastructure/celerity/CelerityStaticResourceResponse.php | 3 +++
 3 files changed, 6 insertions(+)

diff --git a/src/applications/differential/controller/DifferentialRevisionViewController.php b/src/applications/differential/controller/DifferentialRevisionViewController.php
index 94bc4912de..d08471fd83 100644
--- a/src/applications/differential/controller/DifferentialRevisionViewController.php
+++ b/src/applications/differential/controller/DifferentialRevisionViewController.php
@@ -51,6 +51,7 @@ final class DifferentialRevisionViewController extends DifferentialController {
     $diff_vs = $request->getInt('vs');
 
     $target_id = $request->getInt('id');
+    phlog($target_id);
     $target = idx($diffs, $target_id, end($diffs));
 
     $target_manual = $target;
diff --git a/src/applications/differential/view/DifferentialRevisionUpdateHistoryView.php b/src/applications/differential/view/DifferentialRevisionUpdateHistoryView.php
index c10f985b1d..d7764b199d 100644
--- a/src/applications/differential/view/DifferentialRevisionUpdateHistoryView.php
+++ b/src/applications/differential/view/DifferentialRevisionUpdateHistoryView.php
@@ -89,6 +89,8 @@ final class DifferentialRevisionUpdateHistoryView extends AphrontView {
         $new = null;
       }
 
+      phlog($this->selectedVersusDiffID, $this->selectedDiffID);
+
       if ($max_id != $id) {
         $uniq = celerity_generate_unique_node_id();
         $old_checked = ($this->selectedVersusDiffID == $id);
diff --git a/src/infrastructure/celerity/CelerityStaticResourceResponse.php b/src/infrastructure/celerity/CelerityStaticResourceResponse.php
index 08e6da5a42..ccde0280e2 100644
--- a/src/infrastructure/celerity/CelerityStaticResourceResponse.php
+++ b/src/infrastructure/celerity/CelerityStaticResourceResponse.php
@@ -193,6 +193,9 @@ final class CelerityStaticResourceResponse {
       throw new Exception(
         'Literal </script> is not allowed inside inline script.');
     }
+    if (strpos($data, '<!') !== false) {
+      throw new Exception('Literal <! is not allowed inside inline script.');
+    }
     return hsprintf(
       // We don't use <![CDATA[ ]]> because it is ignored by HTML parsers. We
       // would need to send the document with XHTML content type.
-- 
2.51.2