On Dec 31, 2007 6:26 PM, s. isaac dealey <[EMAIL PROTECTED]> wrote:
> > As you point out, it is only unsafe under certain conditions.
>
> What circumstance in which would it be a problem if it escaped the
> </script> string?
>
> I can tell you what circumstance in which that would happen -- NEVER.
Whether it would be NEVER or not, the simple fact is that it's
IMPOSSIBLE for CF to do this. The only way I can think to do it would
be as a postprocessing of the entire generated content (an outbound
servlet filter) with a full HTML and JS parser available. Here's a
relatively simple example (paste it into a text editor and remove any
extra line breaks - there should be 6 lines: CFSET, A, A, carets, A,
carets):
<cfset myTitle = "the end of </script>" />
<a href="javascript:void(0);" onclick="return
confirm('#htmlEditFormat(jsStringFormat("Are you sure you want to view
#myTitle#"))#');">#htmlEditFormat(myTitle)#</a>
<a href="javascript:void(0);" onclick="return
confirm('#htmlEditFormat(replace(jsStringFormat("Are you sure you want
to view #myTitle#"), '</script', '</scr'' + ''ipt',
'all'))#');">#htmlEditFormat(myTitle)#</a>
^
^^ ^^
<a href="javascript:void(0);" onclick="return
confirm('#htmlEditFormat(replace(jsStringFormat("Are you sure you want
to view #myTitle#"), '</script', '',
'all'))#');">#htmlEditFormat(myTitle)#</a>
^
^^
You'll notice that the five carets on line 4 all match. What I want
you to do is replace the string in line 5 denoted by the pair of
carets such that you'll get the escaping you want, but you're NOT
allowed to know what quote is used at the position denoted by the
first caret. It's impossible. You have to know what that first quote
is in order to be able to create the replacement string. And there's
no way to know what that first quote is (it could be ', ', or
".
cheers,
barneyb
--
Barney Boisvert
[EMAIL PROTECTED]
http://www.barneyb.com/
Got Gmail? I have 100 invites.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
Adobe® ColdFusion® 8 software 8 is the most important and dramatic release to
date
Get the Free Trial
http://ad.doubleclick.net/clk;160198600;22374440;w
Archive:
http://www.houseoffusion.com/groups/CF-Talk/message.cfm/messageid:295629
Subscription: http://www.houseoffusion.com/groups/CF-Talk/subscribe.cfm
Unsubscribe:
http://www.houseoffusion.com/cf_lists/unsubscribe.cfm?user=11502.10531.4
