3 ms·
Your html sanitizer should escape ' and "... both characters you're using unescaped. So does this work with a proper sanitizer? Doesn't look like it. If you h
by rgbrenner 9y ago
Your html sanitizer should escape ' and "... both characters you're using unescaped.
So does this work with a proper sanitizer? Doesn't look like it.
If you have a broken sanitizer, or worse youre inserting it without sanitizing it, you're already vulnerable to XSS... this is just a lot of writing showing an exploit caused by a broken sanitizer.
- jakewins 9y agoThis is incorrect; the problem is that htmlspecialchars() doesn't know to escape {{ }}, and that that then allows user input to get interpreted as Vue template expressions. If you have a sanitizer that cleans up ' and ", that'd only serve to limit the vulnerability to executing javascript without quotations in it. That's nowhere near a comfortable place to be - user data should not end up interpreted as Javascript, quotations or not.
- Scryptonite 9y agoYup. Obfusticating using a tool like http://www.jsfuck.com http://www.jsfuck.com would get around the lack of quotations. If the result was too verbose, you can always handroll your own JS: {{constructor.constructor(constructor.name.constructor.fromCharCode(97,108,101,114,116,40,39,120,115,115,39,41))()}}
- deleted 9y ago[deleted]
- krapp 9y ago> the problem is that htmlspecialchars() doesn't know to escape {{ }}, and that that then allows user input to get interpreted as Vue template expressions Arguably, that's not a problem, because '{' and '}' aren't HTML special characters, so the function is working exactly as intended.
- deleted 9y ago[deleted]