6 ms·

"Some people, when confronted with a problem, think "I know, I'll use regular expressions." Now they have two problems." Show me your trivial regex solution to

• Cushman 15y ago
  I'm not saying there's a trivial regex solution to XSS, I'm saying there's a trivial regex solution to disable every one of these so-called "ways" of reloading the page: s/[\.\[=]//g will do the trick. I mean, s/location//g will do the trick too, but I was aiming a little more generic.
  • jrockway 15y ago
    How about "location++"?
    • Cushman 15y ago
      See, there's another clever trick that actually does something interesting. Really, there's a whole class of toString solutions missing from this list... but I guess you have to stop at some point.
    • lanstein 15y ago
      Sorry, what does this do? In Chrome it just redirects to /NaN when you put it in the console, am I missing something?
      • jrockway 15y ago
        Yeah, it causes the browser to go to a new page. += with a string probably works too, but I don't have Chrome here to test with.
  • mike-cardwell 15y ago
    eval(unescape("%64%6F%63%75%6D%65%6E%74%2E%6C%6F%63%61%74%69%6F%6E%2E%68%72%65%66%3D%27%68%74%74%70%73%3A%2F%2F%67%72%65%70%75%6C%61%72%2E%63%6F%6D%2F%27"))
    • patio11 15y ago
      In case the import of this epic retort is lost on anybody: in the real world, you have to pick and code your defense and then the attacker, who gets essentially infinite time to observe the behavior of your defenses, gets to pick their attack string(s). Do not rely on regular expressions or blacklists to sanitize code for you. It will not end well.
    • Cushman 15y ago
      ...and if that were on this list of ways to reload a page in JavaScript that I'm talking about, it would be relevant here. Look, just read what I'm saying. I swear I know what I'm talking about, and I swear I'm not saying you can reliably sanitize JavaScript with a regex. Really. This must be like the FizzBuzz thing— programmers just can't resist a challenge, even if it is explicitly marked as not being a challenge. And thanks for the hscroll :P
      • mike-cardwell 15y ago
        hscroll? Here on Firefox 5, it wraps nicely...
        • Cushman 15y ago
          Huh— I'm on Chrome 13. Just one of those things, I guess.
          • Groxx 15y ago
            /me inspect element -> delete node /me happy Odd, that FF wraps... maybe I'll look into it later today, I kinda wonder why.
• ay 15y ago
  Maybe, rather use something like this: s/</&lt;/g ?