5 ms·

This is unfortunately very out of date now. It is, however, a nice illustration of why your sanitisation regex probably isn't going to work as well as you'd li

This is unfortunately very out of date now. It is, however, a nice illustration of why your sanitisation regex probably isn't going to work as well as you'd like. (Additional notes: http://stackoverflow.com/questions/1732348/regex-match-open-tags-except-xhtml-self-contained-tags/1732454#1732454 http://stackoverflow.com/questions/1732348/regex-match-open-... )

Swizec 15y ago
A very good thing to consider when trying to write a sanitisation regex: HTML is not a regular language. Programming languages are not a regular language. Generally if there are opening and closing statetements -> it is not a regular language. Something that isn't a regular language, cannot be handled by regex.
- jwatzman 15y ago
  Unfortunately what we nowadays call "regular expressions" aren't the regular expressions from math class -- they can match against much more than regular languages. I believe PCRE, i.e., the "regular expression" language for most regex libraries, is Turing-complete though I can't find a citation for that right now.
kyberias 15y ago
Oh god I'm so happy to be a professional programmer and understand this humour.
jerf 15y ago
In what way are you saying it's out of date? The vast, vast bulk of those will work today just fine; very few of them are actually based on browser bugs. Most of them are really about getting valid HTML past dumb filters.
- aj-code 15y ago
  One of the most useful features of that site used to be that you could tell at a glance which browsers the XSS payload would work on, and which it wouldn't. It hasn't been updated for modern browsers so now you have to test each browser yourself. A lot of the payloads aren't based on browser "bugs" as such, more just the way browsers loosely interpret mangled HTML, CSS and JavaScript. Newer browsers tend to be stricter on what they'll interpret, especially when it comes to a potential XSS vector. The site doesn't seem to have been updated for anything after IE7 and Firefox 2, but I'm not aware of any better cheat sheets. Anyone got any?

Swizec 15y ago

A very good thing to consider when trying to write a sanitisation regex: HTML is not a regular language. Programming languages are not a regular language. Generally if there are opening and closing statetements -> it is not a regular language. Something that isn't a regular language, cannot be handled by regex.

jwatzman 15y ago
Unfortunately what we nowadays call "regular expressions" aren't the regular expressions from math class -- they can match against much more than regular languages. I believe PCRE, i.e., the "regular expression" language for most regex libraries, is Turing-complete though I can't find a citation for that right now.

kyberias 15y ago

Oh god I'm so happy to be a professional programmer and understand this humour.

jerf 15y ago

In what way are you saying it's out of date? The vast, vast bulk of those will work today just fine; very few of them are actually based on browser bugs. Most of them are really about getting valid HTML past dumb filters.

aj-code 15y ago
One of the most useful features of that site used to be that you could tell at a glance which browsers the XSS payload would work on, and which it wouldn't. It hasn't been updated for modern browsers so now you have to test each browser yourself. A lot of the payloads aren't based on browser "bugs" as such, more just the way browsers loosely interpret mangled HTML, CSS and JavaScript. Newer browsers tend to be stricter on what they'll interpret, especially when it comes to a potential XSS vector. The site doesn't seem to have been updated for anything after IE7 and Firefox 2, but I'm not aware of any better cheat sheets. Anyone got any?