Re: DOMDocument and <script> tag - XSS test

On Mon, Jul 16, 2012 at 10:25 PM, Anthony Ferrara <ircmaxell@gmail.com> wrote: > This is standard and expected behavior. Since " has no special meaning > within a document (outside of an attribute declaration), there is no > requirement to escape it. And the standard practice when parsing XML/HTML > using a dom based parser is to decode the values. So the "&quot; gets > turned into "". The short answer, is you're doing it wrong, so there's > nothing that *can* be done to prevent the behavior. It's the standard > behavior defined in the standards definitions relating to how to parse HTML > and XML. Well, speaking specifically to the standard practices of dom-based parsers and avoiding the potential security issues, I think most of what you said is correct UNLESS entities are within CDATA, script, or style nodes, in which case the entity should remain in an HTML-aware parser: http://www.w3.org/TR/2004/REC-DOM-Level-3-Core-20040407/introduction.html#ID-E7C30824 That said, please correct me if I'm wrong this (as my wife would tell you, I'm wrong all the time :) Adam