XSS: escape < and > characters in written out XHR response

canjs / can-zone

A context for tracking asynchronous activity in JavaScript applications.

https://v4.canjs.com/doc/can-zone.html

MIT License

92 stars 4 forks source link

XSS: escape < and > characters in written out XHR response #99

Closed matthewp closed 7 years ago

matthewp commented 7 years ago

This escapes < and > to prevent XHR responses from containing script injections.

phillipskevin commented 7 years ago

I don't know that it's actually a problem that we could have due to how the XHR_CACHE is written out, but I think we may also want to escape &. That's what they mention here: https://www.w3.org/International/questions/qa-escapes#use.

matthewp commented 7 years ago

This is what Google's Java JSON serializes escapes: https://github.com/google/gson/blob/0636635cbffa08157bdbd558b1212e4d806474eb/gson/src/main/java/com/google/gson/stream/JsonWriter.java#L157-L161

Maybe we should just do all of those. I'll update.

matthewp commented 7 years ago

@phillipskevin I added 35265c454cb452ea1837fd6fc6995d525f41e97e which escapes more stuff.