3 ms·

I don't know if this is exploitable, but they are using many different methods to escape HTML content: https://github.com/signalapp/Signal-Desktop/blob/d1f7f5e

I don't know if this is exploitable, but they are using many different methods to escape HTML content: https://github.com/signalapp/Signal-Desktop/blob/d1f7f5ee8c1111c2b12a2870c64a830ca0f4fd04/components/mocha/mocha.js#L89 https://github.com/signalapp/Signal-Desktop/blob/d1f7f5ee8c1... Then here it's a different function: https://github.com/signalapp/Signal-Desktop/blob/d1f7f5ee8c1111c2b12a2870c64a830ca0f4fd04/components/mustache/mustache.js#L56 https://github.com/signalapp/Signal-Desktop/blob/d1f7f5ee8c1... Then sometimes they use the underscore library to do it: https://github.com/signalapp/Signal-Desktop/blob/d1f7f5ee8c1111c2b12a2870c64a830ca0f4fd04/components/backbone/backbone.js#L295 https://github.com/signalapp/Signal-Desktop/blob/d1f7f5ee8c1... Which their implementation seems to be using regular expressions as well.

hawkice 8y ago
The first one doesn't escape single quotes or slash, but I have no idea how to get any HTML parser to treat just those as anything but text. Underscore's implementation will be correct, I'm sure.
- codedokode 8y ago
  Slash doesn't need to be encoded. Only 5 characters that have special meaning have to be encoded (&, <, >, " and ').
  - hawkice 8y ago
    Which raises the best question: how would you exploit someone not escaping single quotes? I do not know. Perhaps it isn't possible.
    - jscissr 8y ago
      I think escaping quotes only matters for attributes (which can use ' or "). Example: <img src="$url"> Exploit: foo.jpg" onload="alert('pwned')
      - kuroguro 8y ago
        Heh, found the exact bug on a live bbcode parser some 5 years ago.
        codedokode 8y ago
        It was probably written using regexps? One should make full syntax analysis instead of writing regexp hacks.
pauldino 8y ago
It looks like those are 3 separate third-party libraries (Mocha, Mustache, and Backbone), so each doing HTML escaping a bit differently shouldn't be too surprising.

hawkice 8y ago

The first one doesn't escape single quotes or slash, but I have no idea how to get any HTML parser to treat just those as anything but text. Underscore's implementation will be correct, I'm sure.

codedokode 8y ago
Slash doesn't need to be encoded. Only 5 characters that have special meaning have to be encoded (&, <, >, " and ').
- hawkice 8y ago
  Which raises the best question: how would you exploit someone not escaping single quotes? I do not know. Perhaps it isn't possible.
  - jscissr 8y ago
    I think escaping quotes only matters for attributes (which can use ' or "). Example: <img src="$url"> Exploit: foo.jpg" onload="alert('pwned')
    - kuroguro 8y ago
      Heh, found the exact bug on a live bbcode parser some 5 years ago.
      - codedokode 8y ago
        It was probably written using regexps? One should make full syntax analysis instead of writing regexp hacks.

pauldino 8y ago

It looks like those are 3 separate third-party libraries (Mocha, Mustache, and Backbone), so each doing HTML escaping a bit differently shouldn't be too surprising.