From 1896a6a7a9b344d93821dd4e397122f932dec10b Mon Sep 17 00:00:00 2001 From: Simon Pieters Date: Fri, 5 Feb 2021 10:59:45 +0100 Subject: [PATCH] Escape "<" and ">" when serializing attribute values Avoid a class of XSS attacks where markup goes through a lossy parse-serialize-parse roundtrip and the original attribute value is parsed in the data state. This reverts 4eeb8a1706c9545d5aedb5d569d7f55778da9782. Fixes #6235. --- source | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/source b/source index 1034bc5fd38..8b57cd139a4 100644 --- a/source +++ b/source @@ -136053,14 +136053,15 @@ console.assert(container.firstChild instanceof SuperP);

  • Replace any occurrences of the U+00A0 NO-BREAK SPACE character by the string "&nbsp;".

    • -

  • If the algorithm was invoked in the attribute mode, replace any occurrences of the - """ character by the string "&quot;".

    • +

  • Replace any occurrences of the "<" character by the string + "&lt;".

    • + +

  • Replace any occurrences of the ">" character by the string + "&gt;".

    • -

  • If the algorithm was not invoked in the attribute mode, replace any - occurrences of the "<" character by the string "&lt;", and any occurrences of the ">" character by - the string "&gt;".

    • +

  • If the algorithm was invoked in the attribute mode, then replace any occurrences of + the """ character by the string "&quot;".