Scriptlet argument escaping #3588
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Scriptlets comming from CDN maybe have escaped arguments for sake of backward compatibility with older adblocker engines - this makes them hard to read and debug, so they should be unescaped before injection. Scriptlets arguments that have escape sequences require the escape charactes to be escaped, otherwise when injected they would be evaluated and the scriptlet meaning wont be the same.
chrmod
force-pushed
the
scriptlet-argument-escaping
branch
from
64661f9
to
86d9dc6
Compare
chrmod
force-pushed
the
scriptlet-argument-escaping
branch
from
d33930c
to
cb90d99
Compare
remusao
approved these changes
Nov 9, 2023
chrmod
force-pushed
the
scriptlet-argument-escaping
branch
from
cb90d99
to
ca80a60
Compare
philipp-classen
approved these changes
Nov 10, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Scriptlets comming from CDN maybe have escaped arguments for sake of backward compatibility with older adblocker engines - this makes them hard to read and debug, so they should be unescaped before injection.
Scriptlets arguments that have escape sequences require the escape charactes to be escaped, otherwise when injected they would be evaluated and the scriptlet meaning wont be the same.