Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix slashes as separators. #269

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Fix slashes as separators. #269

wants to merge 1 commit into from

Conversation

hensleysecurity
Copy link

This should resolve #268.

@hensleysecurity hensleysecurity force-pushed the fix-slashes-as-separators branch 4 times, most recently from 843beed to b532e57 Compare December 29, 2022 06:33
@leizongmin
Copy link
Owner

leizongmin commented Mar 23, 2023 •
edited
Loading

The mainstream html parser will parse it into the following results:

[
  {
    "tag": "img",
    "attrs": {
      "width": "100/height=200/src=\"#\"/"
    }
  }
]

image

I think treating the slash as a delimiter might present a potential problem.

@hensleysecurity
Copy link
Author

@leizongmin I am not able to replicate your result. It looks like maybe you wrapped the slashes inside quotes in your source HTML. Please try the following example instead:

<html>
  <body>
    <img/width="100"/height="200"/src="#"/>
  </body>
</html>

I see the behavior I would expect when I try this in Chrome:
console

And Firefox as well:
console2

Also please see the HTML spec:

When the prescan a byte stream to determine its encoding algorithm says to get an attribute, it means doing this:

If the byte at position is one of 0x09 (HT), 0x0A (LF), 0x0C (FF), 0x0D (CR), 0x20 (SP), or 0x2F (/) then advance position to the next byte and redo this step.

In other words, when getting HTML attributes, a properly implemented web browser will treat a / the same as a whitespace character, so I think it's very important that this project's code does the same thing.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

whiteList fails when using slashes to separate tag attributes (PR included)
2 participants
@hensleysecurity @leizongmin