3 ms·

hope they were using more than one pass.... <scr<script>ipt>

• MatmaRex 3y ago
  You can read about some things they did, and didn't! https://samy.pl/myspace/tech.html https://samy.pl/myspace/tech.html
• SeriousM 3y ago
  I wonder how many passes it needs at all. I mean, if you <scr<scr<scr<script>ipt>ipt>ipt> as many times as possible, you'll end up with a xss. Removing < and > at all would be the safest solution.
• charcircuit 3y ago
  You could identify that as not a valid tag in a single pass and know that you should escape the < and > on it. For the implementation all the real HTML tags should be generated by the formatter and not originate from the original input. When formarring the valid tags get deleted from the input and everything else is properly HTML escaped. As a primitive example imagine that the only HTML tags the formatter is able to output is <b> and </b> tags alongside HTML escaped text. That means it will be impossible for a script tag to ever be outputed by the formatter.