Project

General

Profile

Actions

Feature #6620

closed

Add ' to CGI's HTML escaping

Added by drbrain (Eric Hodel) almost 10 years ago. Updated almost 10 years ago.

Status:
Closed
Priority:
Normal
Target version:
[ruby-core:45760]


Related issues 1 (0 open1 closed)

Related to Ruby master - Bug #5485: ERB html_escape should follow OWASP recommendationsClosedshugo (Shugo Maeda)10/26/2011Actions

Updated by xibbar (Takeyuki FUJIOKA) almost 10 years ago

  • Status changed from Open to Assigned
Actions #2

Updated by xibbar (Takeyuki FUJIOKA) almost 10 years ago

  • Status changed from Assigned to Closed
  • % Done changed from 0 to 100

This issue was solved with changeset r36299.
Eric, thank you for reporting this issue.
Your contribution to Ruby is greatly appreciated.
May Ruby be with you.


Wed Jul 4 08:24:28 2012 Takeyuki FUJIOKA

  • lib/cgi/util.rb: Add ' to CGI's HTML escaping.[Feature #6620]

Updated by xibbar (Takeyuki FUJIOKA) almost 10 years ago

  • Status changed from Closed to Rejected

' is not html but xml specification.

Updated by moxley (Moxley Stratton) almost 10 years ago

' is a valid entity for both XHML (http://www.w3.org/TR/xhtml1/dtds.html) and HTML5 (http://www.w3.org/TR/2011/WD-html5-20110525/syntax.html#attributes-0), and is supported by all mainstream browsers. It is a potential security risk not to escape the apostrophe character, because the apostrophe is a valid quote character for attribute values. For example:

name = "' href='javascript:doSomethingBad()"
"Foo"

The above creates a link to "javascript:doSomethingBad()", not "/foo". At the very least, the apostrophe should be escaped to its numeric entity, ' because it is part of HTML syntax.

Updated by xibbar (Takeyuki FUJIOKA) almost 10 years ago

  • Status changed from Rejected to Assigned

Sorry, I confirmed this specification in HTML5.
I will import ' later.
Please wait.

Actions #6

Updated by xibbar (Takeyuki FUJIOKA) almost 10 years ago

  • Status changed from Assigned to Closed

This issue was solved with changeset r36422.
Eric, thank you for reporting this issue.
Your contribution to Ruby is greatly appreciated.
May Ruby be with you.


Wed Jul 18 07:59:29 2012 Takeyuki FUJIOKA

  • lib/cgi/util.rb (CGI.escapeHTML,unescapeHTML): Add ' for HTML5 escaping.
    [Feature #6620]
Actions

Also available in: Atom PDF