Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:61288
Return-Path: <ircmaxell@gmail.com>
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Delivered-To: mailing list internals@lists.php.net
Received: (qmail 70922 invoked from network); 16 Jul 2012 11:31:13 -0000
Received: from unknown (HELO lists.php.net) (127.0.0.1)
  by localhost with SMTP; 16 Jul 2012 11:31:13 -0000
Authentication-Results: pb1.pair.com header.from=ircmaxell@gmail.com; sender-id=pass
Authentication-Results: pb1.pair.com smtp.mail=ircmaxell@gmail.com; spf=pass; sender-id=pass
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.216.170 as permitted sender)
X-PHP-List-Original-Sender: ircmaxell@gmail.com
X-Host-Fingerprint: 209.85.216.170 mail-qc0-f170.google.com  
Received: from [209.85.216.170] ([209.85.216.170:35317] helo=mail-qc0-f170.google.com)
	by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP
	id 64/61-63072-08BF3005 for <internals@lists.php.net>; Mon, 16 Jul 2012 07:31:12 -0400
Received: by qcmt36 with SMTP id t36so3652337qcm.29
        for <internals@lists.php.net>; Mon, 16 Jul 2012 04:31:10 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=20120113;
        h=mime-version:in-reply-to:references:date:message-id:subject:from:to
         :cc:content-type;
        bh=nU6g+2Va9V3d49biH3fXWJ0aNvwuefb753DaRfYJI50=;
        b=OqfFISyxYe+NCzqxWuGGZbtZ1F8n8YX1XHVurtutrFqZ2cvmX2c3I2qbNxBfGk7p+S
         ahrtz+mB8PNInyIsEfzFpZ3/pDMMTXeKk+x9L/fuL94t1pXQPlQF58N/eRxsG4xSQfpY
         +Nh3MKByY25WOWHHN4i0eN5/JGUGX6TXSXeqGZVmxX8QYqwGzsd940tD3wWwqeWlkAKl
         G99F8qvFnON6Aj+iNXYc5fMUjyhkcPs/xk3AalfvFnYSQsY20nlPFXn19zGqW/uArSou
         0o9xOqDPqNRgqWUx0dpgg80uH3aj0pbc0623xWN+4yYw53eRSXcqLF6EmFkFntZ+Lxt1
         zWMA==
MIME-Version: 1.0
Received: by 10.229.135.202 with SMTP id o10mr5902894qct.19.1342438270008;
 Mon, 16 Jul 2012 04:31:10 -0700 (PDT)
Received: by 10.229.182.4 with HTTP; Mon, 16 Jul 2012 04:31:09 -0700 (PDT)
In-Reply-To: <CAJRMtAHphgKXkBcD0YW24HUob+a27=xKo6V2qi4WMzYG+Vw=+w@mail.gmail.com>
References: <CAJRMtAHphgKXkBcD0YW24HUob+a27=xKo6V2qi4WMzYG+Vw=+w@mail.gmail.com>
Date: Mon, 16 Jul 2012 07:31:09 -0400
Message-ID: <CAAyV7nEOVMRKmFvcxdnjb9YW5HZSt3JnbpkPG+vOHoxLz-qPFw@mail.gmail.com>
To: Raymond Irving <xwisdom@gmail.com>
Cc: internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=00248c6a66ba377fb404c4f0c406
Subject: Re: [PHP-DEV] DOMDocument and <script> tag - XSS test
From: ircmaxell@gmail.com (Anthony Ferrara)

--00248c6a66ba377fb404c4f0c406
Content-Type: text/plain; charset=ISO-8859-1

The problem is that you're escaping incorrectly for the context. It takes
more than just htmlspecialchars to escape for a javascript data context.

Check this out:

https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet#RULE_.233_-_JavaScript_Escape_Before_Inserting_Untrusted_Data_into_JavaScript_Data_Values


Anthony

On Mon, Jul 16, 2012 at 12:54 AM, Raymond Irving <xwisdom@gmail.com> wrote:

> Hello,
>
> I'm having a problem with the DOM parser:
>
> If I load the following using DOMDocument->loadHTML():
>
> <script type="text/javascript"><!--
>    var d="&quot;;alert('This is an XSS test'); //";
> </script>
>
> it will be converted to:
>
> <script type="text/javascript"><!--
>    var d="";alert('This is an XSS test'); //";
> </script>
>
> This is because parser is substituting '&quot;' for  '"'.
>
> Is there a way to prevent this from happening?
>
> __
> Raymond
>

--00248c6a66ba377fb404c4f0c406--