2011/6/15 felix <[email protected]>: > On Wed, Jun 15, 2011 at 11:57, Mike Samuel <[email protected]> wrote: >> 2011/6/15 Gareth <[email protected]>: >>> It's a nice idea but within the constructor call you are using a >>> regular expression literal, you'd have to watch out for IE quirks (if >>> you're supporting it) in regex parsing. For example:- >>> /[^]/]/,alert(1) >> >> Good point. I knew that [^] as a better way of saying any character >> doesn't work on IE but didn't know why. >> >> To avoid this, we could disallow any regular expression literals >> controlled by an attacker in the output by replacing >> >> /foo/i >> >> with >> >> /./.constructor("foo", "i") >> >> Still a token-level transformation. > > That unfortunately means the regexp will be unnecessarily recompiled > in some engines, but it shouldn't be too hard to use either a literal > regexp or a literal string depending on how reliably it will be > parsed.
True. We could chose the syntactically verbose, but basically identity function if the regexp body looks legit across all major interpreters.
