On Wed, Jun 15, 2011 at 11:57, Mike Samuel <[email protected]> wrote: > 2011/6/15 Gareth <[email protected]>: >> It's a nice idea but within the constructor call you are using a >> regular expression literal, you'd have to watch out for IE quirks (if >> you're supporting it) in regex parsing. For example:- >> /[^]/]/,alert(1) > > Good point. I knew that [^] as a better way of saying any character > doesn't work on IE but didn't know why. > > To avoid this, we could disallow any regular expression literals > controlled by an attacker in the output by replacing > > /foo/i > > with > > /./.constructor("foo", "i") > > Still a token-level transformation.
That unfortunately means the regexp will be unnecessarily recompiled in some engines, but it shouldn't be too hard to use either a literal regexp or a literal string depending on how reliably it will be parsed.
