" getting rendered as ", without a semicolon #362
Comments
|
I believe this is expected behavior. While it's true that the missing semicolon causes a parse error, according to the spec the parser behaves as if the semicolon was present:
The browsers I've tested behave the same way. Given the following HTML browsers show <!DOCTYPE html>
<html>
<body>
<p>A " B</p>
</body>
</html>What's your use case? Is the query string you're sanitizing part of an HTTP request you're handling? |
|
Interesting - that's unexpected on our end, but if browsers follow the same spec, there's little to argue. Yes - we've added sanatization in our middleware that strips out any XSS in the request path, body, and query string to further hardern our API. This was obviously a very unexpected edge case - and solved fairly easily by sending "quoteId" with a capital Q instead of its lowercase form. |
|
IMHO this is not the ideal level to apply sanitization at. Perhaps it's better to sanitize only those strings that are intended to be rendered back to HTML. So let your server side code decode the query string and apply validation, then sanitize only the relevant parameters that are supposed to be rendered back out later (like user comments etc). This would prevent the issue you have encountered. For example: First, decode the query string into (pseudo code) Then sanitize only |
Hello!
We recently began sanitize sitewide of all requests and had a very strange production issue. We sanitize all incoming query string parameters, and only one our APIs began suddenly failing.
After many red herrings, the issue was discovered: our query string had multiple parameters, and the parameter quoteId was behind an &. See screenshot below for the translation found in our logs:
In the short term, we've capitalize the Q which solves the problem, but I believe " should not be rendered as " if there is no semicolon since the proper HTML entity is " ; (needed to add a space - Github renders it as " otherwise!)
Thanks - this project has been very helpful!
The text was updated successfully, but these errors were encountered: