Edgewall Software

Opened 12 years ago

Last modified 8 years ago

#527 new defect

_strip_css_comments may be unable to delete a comment

Reported by: uchida_t <dc578av_adle@…> Owned by: cmlenz
Priority: major Milestone: 0.9
Component: General Version: 0.6
Keywords: Cc:

Description

http://genshi.edgewall.org/browser/trunk/genshi/filters/html.py?rev=1175#L541

_strip_css_comments is called only once.
So in the following description, a css comment remains.

//#!html
<div style="width: exp//**/**/ression(alert(1))">div</div>

I think this code is better.

    def _strip_css_comments(self, text):
        while True:
            s = self._CSS_COMMENTS('', text)
            if s == text:
                return s

Change History (2)

comment:1 in reply to: ↑ description Changed 12 years ago by dc578av_adle@…

Replying to uchida_t <dc578av_adle@…>:

    def _strip_css_comments(self, text):
        while True:
            s = self._CSS_COMMENTS('', text)
            if s == text:
                return s

Sorry

    def _strip_css_comments(self, text):
        while True:
            s = self._CSS_COMMENTS('', text)
            if s == text:
                return s
            text = s

comment:2 Changed 8 years ago by hodgestar

  • Milestone changed from 0.7 to 0.9

Moved to milestone 0.9.

Note: See TracTickets for help on using tickets.