4 ms·
This is incorrect; the problem is that htmlspecialchars() doesn't know to escape {{ }}, and that that then allows user input to get interpreted as Vue template
by jakewins 9y ago
This is incorrect; the problem is that htmlspecialchars() doesn't know to escape {{ }}, and that that then allows user input to get interpreted as Vue template expressions.
If you have a sanitizer that cleans up ' and ", that'd only serve to limit the vulnerability to executing javascript without quotations in it. That's nowhere near a comfortable place to be - user data should not end up interpreted as Javascript, quotations or not.
- Scryptonite 9y agoYup. Obfusticating using a tool like http://www.jsfuck.com http://www.jsfuck.com would get around the lack of quotations. If the result was too verbose, you can always handroll your own JS: {{constructor.constructor(constructor.name.constructor.fromCharCode(97,108,101,114,116,40,39,120,115,115,39,41))()}}
- deleted 9y ago[deleted]
- krapp 9y ago> the problem is that htmlspecialchars() doesn't know to escape {{ }}, and that that then allows user input to get interpreted as Vue template expressions Arguably, that's not a problem, because '{' and '}' aren't HTML special characters, so the function is working exactly as intended.