Looking at what GMail did to the formatting, I've posted the raw source here:
http://barneyb.com/rhino/jsstringformat.txt cheers, barneyb On Dec 31, 2007 7:26 PM, Barney Boisvert <[EMAIL PROTECTED]> wrote: > On Dec 31, 2007 6:26 PM, s. isaac dealey <[EMAIL PROTECTED]> wrote: > > > As you point out, it is only unsafe under certain conditions. > > > > What circumstance in which would it be a problem if it escaped the > > </script> string? > > > > I can tell you what circumstance in which that would happen -- NEVER. > > Whether it would be NEVER or not, the simple fact is that it's > IMPOSSIBLE for CF to do this. The only way I can think to do it would > be as a postprocessing of the entire generated content (an outbound > servlet filter) with a full HTML and JS parser available. Here's a > relatively simple example (paste it into a text editor and remove any > extra line breaks - there should be 6 lines: CFSET, A, A, carets, A, > carets): > > <cfset myTitle = "the end of </script>" /> > <a href="javascript:void(0);" onclick="return > confirm('#htmlEditFormat(jsStringFormat("Are you sure you want to view > #myTitle#"))#');">#htmlEditFormat(myTitle)#</a> > <a href="javascript:void(0);" onclick="return > confirm('#htmlEditFormat(replace(jsStringFormat("Are you sure you want > to view #myTitle#"), '</script', '</scr'' + ''ipt', > 'all'))#');">#htmlEditFormat(myTitle)#</a> > ^ > > ^^ ^^ > <a href="javascript:void(0);" onclick="return > confirm('#htmlEditFormat(replace(jsStringFormat("Are you sure you want > to view #myTitle#"), '</script', '', > 'all'))#');">#htmlEditFormat(myTitle)#</a> > ^ > > ^^ > > You'll notice that the five carets on line 4 all match. What I want > you to do is replace the string in line 5 denoted by the pair of > carets such that you'll get the escaping you want, but you're NOT > allowed to know what quote is used at the position denoted by the > first caret. It's impossible. You have to know what that first quote > is in order to be able to create the replacement string. And there's > no way to know what that first quote is (it could be ', ', or > ". > > cheers, > barneyb > > -- > Barney Boisvert > [EMAIL PROTECTED] > http://www.barneyb.com/ > > Got Gmail? I have 100 invites. > -- Barney Boisvert [EMAIL PROTECTED] http://www.barneyb.com/ Got Gmail? I have 100 invites. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~| Adobe® ColdFusion® 8 software 8 is the most important and dramatic release to date Get the Free Trial http://ad.doubleclick.net/clk;160198600;22374440;w Archive: http://www.houseoffusion.com/groups/CF-Talk/message.cfm/messageid:295630 Subscription: http://www.houseoffusion.com/groups/CF-Talk/subscribe.cfm Unsubscribe: http://www.houseoffusion.com/cf_lists/unsubscribe.cfm?user=11502.10531.4
