Closed jpasski closed 11 years ago
I agree that <
itself is a nop for the JS string. We really care about few string literals that are related to HTML tags:
</script>
, <!--<script>
, and </style>
. Note that the latest should not be necessary, as this should be handled by the parent context escaper/sanitizer -- in this case we'd be in a RAWTEXT <style>
. So in short, </
is good, but don't forget <!
either. If you want to optimize even more, look for the previous string literals, and only escape in that case (obviously, in addition to quotes and stuff).
The proposal from Jim/OWASP seems fair (aka <
appear in JS strings), but it really sounds like a micro-optimization. I understand that for some people the output size matters (aka Google, Facebook, etc.) but for most, they really don't care about how many bytes you generate from an escaper.
Also, we coud try to use the minimal escape sequence (mostly backslash and hex then, unicode only for U+2028
/U+2029
) for each escaped character, but it lacks consistency IMO, and that's not great for the devs. Easy enough though to have an option (or other version of the lib) that would generate the minimal escape sequences.
Jim, does OWASP have a ML or a place to discuss such subject? I couldn't find anything with the content of this discussion.
Closing, timed out.
From Jim Manico via email. (Jim authorized the content of the email to be posted in this bug).
Email: