4 ms·
They seriously tried to parse HTML with regex? That's crazy.
by orenlindsey 3y ago
They seriously tried to parse HTML with regex? That's crazy.
- charcircuit 3y agoThey were using regex to block bad input without needing to parse HTML.
- samatman 3y agohope they were using more than one pass.... <scr<script>ipt>
- MatmaRex 3y agoYou can read about some things they did, and didn't! https://samy.pl/myspace/tech.html https://samy.pl/myspace/tech.html
- SeriousM 3y agoI wonder how many passes it needs at all. I mean, if you <scr<scr<scr<script>ipt>ipt>ipt> as many times as possible, you'll end up with a xss. Removing < and > at all would be the safest solution.
- charcircuit 3y agoYou could identify that as not a valid tag in a single pass and know that you should escape the < and > on it. For the implementation all the real HTML tags should be generated by the formatter and not originate from the original input. When formarring the valid tags get deleted from the input and everything else is properly HTML escaped. As a primitive example imagine that the only HTML tags the formatter is able to output is <b> and </b> tags alongside HTML escaped text. That means it will be impossible for a script tag to ever be outputed by the formatter.
- dlnovell 3y agohttps://stackoverflow.com/a/1732454/378171 https://stackoverflow.com/a/1732454/378171
- sebmaynard 3y agoLong live Tony the Pony.
- MatmaRex 3y agoIt used to be that the only programs capable of somewhat correctly parsing HTML were web browsers, each one of them produced different results, most weren't open-source, and none were reusable as libraries. If you wanted to parse HTML in... looks up what MySpace was written in... ColdFusion, you were all out of luck. Since then people spent years developing specifications and writing the libraries, so now it's not a big deal.