Edgewall Software
Modify

Opened 4 years ago

Last modified 4 years ago

#527 new defect

_strip_css_comments may be unable to delete a comment

Reported by: uchida_t <dc578av_adle@…> Owned by: cmlenz
Priority: major Milestone: 0.7
Component: General Version: 0.6
Keywords: Cc:

Description

http://genshi.edgewall.org/browser/trunk/genshi/filters/html.py?rev=1175#L541

_strip_css_comments is called only once.
So in the following description, a css comment remains.

//#!html
<div style="width: exp//**/**/ression(alert(1))">div</div>

I think this code is better.

    def _strip_css_comments(self, text):
        while True:
            s = self._CSS_COMMENTS('', text)
            if s == text:
                return s

Attachments (0)

Change History (1)

comment:1 in reply to: ↑ description Changed 4 years ago by dc578av_adle@…

Replying to uchida_t <dc578av_adle@…>:

    def _strip_css_comments(self, text):
        while True:
            s = self._CSS_COMMENTS('', text)
            if s == text:
                return s

Sorry

    def _strip_css_comments(self, text):
        while True:
            s = self._CSS_COMMENTS('', text)
            if s == text:
                return s
            text = s

Add Comment

Modify Ticket

Change Properties
Set your email in Preferences
Action
as new The owner will remain cmlenz.
as The resolution will be set. Next status will be 'closed'.
to The owner will be changed from cmlenz to the specified user. Next status will be 'new'.
The owner will be changed from cmlenz to anonymous. Next status will be 'assigned'.
Author


E-mail address and user name can be saved in the Preferences.

 
Note: See TracTickets for help on using tickets.