Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Escape / as well #2650

Closed
wants to merge 1 commit into from
Closed

Escape / as well #2650

wants to merge 1 commit into from

Conversation

mitar
Copy link

@mitar mitar commented Feb 10, 2017

It is on OWASP recommended list.

@coveralls
Copy link

coveralls commented Feb 10, 2017 •
edited

Coverage Status

Coverage remained the same at 96.763% when pulling 6015200 on mitar:patch-2 into 6611850 on jashkenas:master.

@captbaritone
Copy link
Collaborator

Can you point to a specific example of where this would be a problem?

@mitar
Copy link
Author

mitar commented Feb 15, 2017 •
edited

http://security.stackexchange.com/a/151424/99938

Other libraries are also doing it: https://www.npmjs.com/package/xss-escape

@mitar
Copy link
Author

mitar commented Feb 15, 2017

This is a valid HTML 4:

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"
  "http://www.w3.org/TR/html4/strict.dtd">
<html>
<head>
<title/hello/
<body>
<p/hello/

See how / has a special meaning?

@akre54
Copy link
Collaborator

akre54 commented Feb 16, 2017

#1189

@akre54 akre54 closed this Feb 16, 2017
@mitar mitar mentioned this pull request Feb 16, 2017
Closed
@mitar
Copy link
Author

mitar commented Feb 16, 2017

I think that conversation is invalid. Please reopen this pull request. Nobody there made any serious computer security argument. Just saying that "because I do not know how this could be exploited" is not an argument why this should not be done.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
duplicate
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
4 participants
@mitar @coveralls @captbaritone @akre54