5 ms·
When you search for "${", the page is missing 26 lines of minified JavaScript (lines 9-35 of a non-broken page, at least for me), almost certainly because of a
by cfinke 15y ago
When you search for "${", the page is missing 26 lines of minified JavaScript (lines 9-35 of a non-broken page, at least for me), almost certainly because of a templating bug. These lines, among other things, are responsible for adding the top toolbar to the page. (The missing JS is here: http://pastebin.com/B9cy3T2c http://pastebin.com/B9cy3T2c)
- jcampbell1 15y agoI think google search uses this templating language: http://code.google.com/p/google-ctemplate/ http://code.google.com/p/google-ctemplate/ It makes sense that the ${ could cause problems.
- tptacek 15y agoHrm, but is $ a metacharacter in that language?
- RyanKearney 15y agoHrm, did you click the link?
- irahul 15y agoMost likely he did. Did you? If you did click and skim the page at 1000000000 words/sec, those `$` over there are for USD, and not part of templating system.
- brlewis 15y agoNo. It doesn't even appear on http://google-ctemplate.googlecode.com/svn/trunk/doc/reference.html http://google-ctemplate.googlecode.com/svn/trunk/doc/referen...
- simonw 15y agoIn my experience it's pretty rare for template language bugs to cause errors if user entered content includes one of their special characters. The template would have to be evaluated twice for any problems to occur - once to insert the user's template code in to placeholders within the original template , and then once again to execute the resulting combination.
- kragen 15y agoSad to say, Mustache.js has exactly this bug last time I checked, but only under some circumstances. Minimal reproduction: Mustache.to_html('{{b}}', {b: '{{c}x}' }) -> '{{c}x}' Mustache.to_html('{{#a}}{{b}}{{/a}}', {a: [{b: '{{c}x}' }]}) -> '{{c}x}' Mustache.to_html('{{b}}', {b: '{{c}}' }) -> '{{c}}' Mustache.to_html('{{#a}}{{b}}{{/a}}', {a: [{b: '{{c}}' }]}) -> '' (wrong)
- tcarnell 15y agoI disagree! It does not make sense that submitting any text via a form input should in any way interfere with a templating engine, in the same way we dont expect to be able to affect a database by entering SQL into a form field. The fact that Google brings back an empty result set to me indicates the problem is a bit deeper...
- vinhboy 15y agoCan you tell us what tools you used to find all this info and to un-minify their js? thanks!
- cfinke 15y agoI did a diff of the source code for a SERP for "${" and a SERP for "$$", ignored any lines that were the same except for s/${/$$/, and then un-minified with http://jsbeautifier.org/ http://jsbeautifier.org/