8000 Escape "<" and ">" when serializing attribute values · whatwg/html@ac056b2 · GitHub
[go: up one dir, main page]
Skip to content

Commit ac056b2

Browse files
zcorpanzcorpan
committed
Escape "<" and ">" when serializing attribute values
Avoid a class of XSS attacks where markup goes through a lossy parse-serialize-parse roundtrip and the original attribute value is parsed in the data state. This reverts 4eeb8a1. Fixes #6235.
1 parent b43cdf4 commit ac056b2

File tree

1 file changed

+8
-7
lines changed

1 file changed

+8
-7
lines changed

‎source‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
112246112246
<li><p>Replace any occurrences of the U+00A0 NO-BREAK SPACE character by the string "<code
112247112247
data-x="">&amp;nbsp;</code>".</p></li>
112248112248

112249-
<li><p>If the algorithm was invoked in the <i>attribute mode</i>, replace any occurrences of the
112250-
"<code data-x="">&quot;</code>" character by the string "<code
112251-
data-x="">&amp;quot;</code>".</p></li>
112249+
<li><p>Replace any occurrences of the "<code data-x="">&lt;</code>" character by the string
112250+
"<code data-x="">&amp;lt;</code>".</p></li>
112251+
112252+
<li><p>Replace any occurrences of the "<code data-x="">&gt;</code>" character by the string
112253+
"<code data-x="">&amp;gt;</code>".</p></li>
112252112254

112253-
<li><p>If the algorithm was <em>not</em> invoked in the <i>attribute mode</i>, replace any
112254-
occurrences of the "<code data-x="">&lt;</code>" character by the string "<code
112255-
data-x="">&amp;lt;</code>", and any occurrences of the "<code data-x="">&gt;</code>" character by
112256-
the string "<code data-x="">&amp;gt;</code>".</p></li>
112255+
<li><p>If the algorithm was invoked in the <i>attribute mode</i>, then replace any occurrences of
112256+
the "<code data-x="">&quot;</code>" character by the string "<code
112257+
data-x="">&amp;quot;</code>".</p></li>
112257112258
</ol>
112258112259

112259112260

0 commit comments

Comments
 (0)
0