Skip to content
This repository has been archived by the owner on Mar 7, 2021. It is now read-only.

Pattern for CSS url() syntax matches wrongly also some JS url() function calls #441

Closed
florianheinze opened this issue Oct 29, 2018 · 0 comments

Comments

@florianheinze
Copy link

In the discoverRegex patterns, the /\s?url\([^"'].*?\)/ig has a dot too much.

If there is e.g. JavaScript code like foo;url();bar();doo the pattern matches url();bar(). The reason is that the [^"'] consumes already the first ) closing bracket in the haystack, and so the following \) has nothing to match anymore.

A simple fix is to strip the . and just use the [^"'] as our wildcard, like /\s?url\([^"')]*?\)/ig.

This problem can lead to crawling URLs with strange JS code appended to it. Like http://example.com/%29;bar%28

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant