Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:61331
Return-Path: <ircmaxell@gmail.com>
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Delivered-To: mailing list internals@lists.php.net
Received: (qmail 76853 invoked from network); 17 Jul 2012 02:25:39 -0000
Received: from unknown (HELO lists.php.net) (127.0.0.1)
  by localhost with SMTP; 17 Jul 2012 02:25:39 -0000
Authentication-Results: pb1.pair.com header.from=ircmaxell@gmail.com; sender-id=pass
Authentication-Results: pb1.pair.com smtp.mail=ircmaxell@gmail.com; spf=pass; sender-id=pass
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.216.170 as permitted sender)
X-PHP-List-Original-Sender: ircmaxell@gmail.com
X-Host-Fingerprint: 209.85.216.170 mail-qc0-f170.google.com  
Received: from [209.85.216.170] ([209.85.216.170:34857] helo=mail-qc0-f170.google.com)
	by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP
	id B2/52-62735-22DC4005 for <internals@lists.php.net>; Mon, 16 Jul 2012 22:25:39 -0400
Received: by qcmt36 with SMTP id t36so4249087qcm.29
        for <internals@lists.php.net>; Mon, 16 Jul 2012 19:25:36 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=20120113;
        h=mime-version:in-reply-to:references:date:message-id:subject:from:to
         :cc:content-type;
        bh=JLNww2k6j53XEQwrwMEecLORs1Qld8ZXFAtVvV49ETg=;
        b=gxcT/EXUkIo5vLVAoyTDmSkf/4ecydRM+XEF3V6+1OM3s8oUegr5pig7VW3/wB8g/8
         oB/8QrXp37+Oy1eUyZsrsU0pz092frLSjB05qwOyJ5aO8m3AFzg/hBCM1eaVPiBMDc8w
         MHRbVpiUXwjab1bXIg4GWyaUPzMrWEaN36/wFtkgud+K7GH4frsMwcoiBw3Gn/vFa4uS
         cwMEExlbXwyQWP1AhWGa1OpFHASnUq4ZQ4OWApg7azbH2xmQz9zh6KvY72reykkFMidN
         2Pnap8Q/3TtMVd24rvpEEhPijugC+jG9gg2l0au8uWOcWHrz+B4bRc9B8Pqh1t9MY2rJ
         Ib+Q==
MIME-Version: 1.0
Received: by 10.229.136.14 with SMTP id p14mr316512qct.93.1342491936120; Mon,
 16 Jul 2012 19:25:36 -0700 (PDT)
Received: by 10.229.182.4 with HTTP; Mon, 16 Jul 2012 19:25:36 -0700 (PDT)
In-Reply-To: <CAJRMtAH6ed8A2BqF2YBQoaqkm+wWxoGo4aWjcCr+Qj=wktXv8A@mail.gmail.com>
References: <CAJRMtAHphgKXkBcD0YW24HUob+a27=xKo6V2qi4WMzYG+Vw=+w@mail.gmail.com>
	<CAAyV7nEOVMRKmFvcxdnjb9YW5HZSt3JnbpkPG+vOHoxLz-qPFw@mail.gmail.com>
	<CAJRMtAH6ed8A2BqF2YBQoaqkm+wWxoGo4aWjcCr+Qj=wktXv8A@mail.gmail.com>
Date: Mon, 16 Jul 2012 22:25:36 -0400
Message-ID: <CAAyV7nGkydKMFE3N4XzUr14cj1Qdi2KTWWdUNoBktUQOhJVd8A@mail.gmail.com>
To: Raymond Irving <xwisdom@gmail.com>
Cc: internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=00248c711847f7613404c4fd422d
Subject: Re: [PHP-DEV] DOMDocument and <script> tag - XSS test
From: ircmaxell@gmail.com (Anthony Ferrara)

--00248c711847f7613404c4fd422d
Content-Type: text/plain; charset=ISO-8859-1

Raymond

On Mon, Jul 16, 2012 at 9:30 PM, Raymond Irving <xwisdom@gmail.com> wrote:

> Hi Anthony,
>
> Thanks for the feedback. I do get your point about escaping for JavaScript
> but the example shown was just to highlight the entity substitution issue
> which could lead to unexpected results. In this case a developer might want
> to use jQuery to append some html escaped values to an element which would
> result in an error of a possible XSS attack.
>
> IMO there should be a feature to control or prevent this behavior.
>

This is standard and expected behavior. Since " has no special meaning
within a document (outside of an attribute declaration), there is no
requirement to escape it. And the standard practice when parsing XML/HTML
using a dom based parser is to decode the values. So the "&quot; gets
turned into "". The short answer, is you're doing it wrong, so there's
nothing that *can* be done to prevent the behavior. It's the standard
behavior defined in the standards definitions relating to how to parse HTML
and XML.

Escape things properly, and you won't have to work around implementation
details...

Anthony

--00248c711847f7613404c4fd422d--