Feature #6620
closed
Updated by xibbar (Takeyuki FUJIOKA) almost 13 years ago
- Status changed from Open to Assigned
Updated by xibbar (Takeyuki FUJIOKA) almost 13 years ago
- Status changed from Assigned to Closed
- % Done changed from 0 to 100
This issue was solved with changeset r36299.
Eric, thank you for reporting this issue.
Your contribution to Ruby is greatly appreciated.
May Ruby be with you.
Wed Jul 4 08:24:28 2012 Takeyuki FUJIOKA [email protected]
- lib/cgi/util.rb: Add ' to CGI's HTML escaping.[Feature #6620]
Updated by xibbar (Takeyuki FUJIOKA) almost 13 years ago
- Status changed from Closed to Rejected
' is not html but xml specification.
Updated by moxley (Moxley Stratton) almost 13 years ago
' is a valid entity for both XHML (http://www.w3.org/TR/xhtml1/dtds.html) and HTML5 (http://www.w3.org/TR/2011/WD-html5-20110525/syntax.html#attributes-0), and is supported by all mainstream browsers. It is a potential security risk not to escape the apostrophe character, because the apostrophe is a valid quote character for attribute values. For example:
name = "' href='javascript:doSomethingBad()"
"Foo"
The above creates a link to "javascript:doSomethingBad()", not "/foo". At the very least, the apostrophe should be escaped to its numeric entity, ' because it is part of HTML syntax.
Updated by xibbar (Takeyuki FUJIOKA) almost 13 years ago
- Status changed from Rejected to Assigned
Sorry, I confirmed this specification in HTML5.
I will import ' later.
Please wait.
Updated by xibbar (Takeyuki FUJIOKA) almost 13 years ago
- Status changed from Assigned to Closed
This issue was solved with changeset r36422.
Eric, thank you for reporting this issue.
Your contribution to Ruby is greatly appreciated.
May Ruby be with you.
Wed Jul 18 07:59:29 2012 Takeyuki FUJIOKA [email protected]
- lib/cgi/util.rb (CGI.escapeHTML,unescapeHTML): Add ' for HTML5 escaping.
[Feature #6620]