Project

General

Profile

Actions

Feature #6620

closed

Add ' to CGI's HTML escaping

Feature #6620: Add ' to CGI's HTML escaping

Added by drbrain (Eric Hodel) over 13 years ago. Updated about 13 years ago.

Status:
Closed
Target version:
[ruby-core:45760]


Related issues 1 (0 open1 closed)

Related to Ruby - Bug #5485: ERB html_escape should follow OWASP recommendationsClosedshugo (Shugo Maeda)Actions

Updated by xibbar (Takeyuki FUJIOKA) over 13 years ago Actions #1 [ruby-core:46152]

  • Status changed from Open to Assigned

Updated by xibbar (Takeyuki FUJIOKA) over 13 years ago Actions #2

  • Status changed from Assigned to Closed
  • % Done changed from 0 to 100

This issue was solved with changeset r36299.
Eric, thank you for reporting this issue.
Your contribution to Ruby is greatly appreciated.
May Ruby be with you.


Wed Jul 4 08:24:28 2012 Takeyuki FUJIOKA

  • lib/cgi/util.rb: Add ' to CGI's HTML escaping.[Feature #6620]

Updated by xibbar (Takeyuki FUJIOKA) over 13 years ago Actions #3 [ruby-core:46161]

  • Status changed from Closed to Rejected

' is not html but xml specification.

Updated by moxley (Moxley Stratton) over 13 years ago Actions #4 [ruby-core:46260]

' is a valid entity for both XHML (http://www.w3.org/TR/xhtml1/dtds.html) and HTML5 (http://www.w3.org/TR/2011/WD-html5-20110525/syntax.html#attributes-0), and is supported by all mainstream browsers. It is a potential security risk not to escape the apostrophe character, because the apostrophe is a valid quote character for attribute values. For example:

name = "' href='javascript:doSomethingBad()"
"Foo"

The above creates a link to "javascript:doSomethingBad()", not "/foo". At the very least, the apostrophe should be escaped to its numeric entity, ' because it is part of HTML syntax.

Updated by xibbar (Takeyuki FUJIOKA) over 13 years ago Actions #5 [ruby-core:46288]

  • Status changed from Rejected to Assigned

Sorry, I confirmed this specification in HTML5.
I will import ' later.
Please wait.

Updated by xibbar (Takeyuki FUJIOKA) about 13 years ago Actions #6

  • Status changed from Assigned to Closed

This issue was solved with changeset r36422.
Eric, thank you for reporting this issue.
Your contribution to Ruby is greatly appreciated.
May Ruby be with you.


Wed Jul 18 07:59:29 2012 Takeyuki FUJIOKA

  • lib/cgi/util.rb (CGI.escapeHTML,unescapeHTML): Add ' for HTML5 escaping.
    [Feature #6620]
Actions

Also available in: PDF Atom