False positive for "wordContainingFile(" in _sanitize_naughty_javascript

[Fahl-Design]

Hi, I think i stumbled on a false positive in _sanitize_naughty_javascript

What is this feature about (expected vs actual behaviour)?

• do no detect XSS

How can I reproduce it?

$str = '<p>Montageprofile(n)</p>';

$antiXss = new \voku\helper\AntiXSS(); 
$antiXss->xss_clean($str);

assert(false === $antiXss->isXssFound());

Does it take minutes, hours or days to fix?

• minutes, maybe

Any additional information?

https://github.com/voku/anti-xss/blob/master/src/voku/helper/AntiXSS.php#L1680:L1721

• regex is missing a space before the keyword pattern, blablafile(n) is no valid js

[voku]

Good catch, can you create a pull request? 👍

[Fahl-Design]

Yes for sure :) I will push one later today

[Fahl-Design]

I fixed this one and found an other, _do_never_allowed_afterwards is a bit "aggressive" when it comes to "onEnd" events, I will give it a try tomorrow,
the PR is able to merge anyway

[mike-healy]

I think this issue is similar to a problem I'm having with text like system (… being considered dangerous.
For example the string the operating system (e.g. Windows 10, Mac OS X etc.) you are using is considered to contain XSS.

Would a similar change for system work?
@voku , @Fahl-Design