You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@sling.apache.org by "ASF GitHub Bot (JIRA)" <ji...@apache.org> on 2014/11/20 12:49:33 UTC
[jira] [Commented] (SLING-4177) Sightly: StyleString context
doesn't properly escape
[ https://issues.apache.org/jira/browse/SLING-4177?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14219300#comment-14219300 ]
ASF GitHub Bot commented on SLING-4177:
---------------------------------------
GitHub user vladbailescu opened a pull request:
https://github.com/apache/sling/pull/46
SLING-4177 - Added escaping for styleString context
* added a new method for style string escaping to XSS API
* added implementation (using OWASP encoder) and tests
* added string escaping in Sightly for styleString context
You can merge this pull request into a Git repository by running:
$ git pull https://github.com/vladbailescu/sling SLING-4177-escape-stylestring
Alternatively you can review and apply these changes as the patch at:
https://github.com/apache/sling/pull/46.patch
To close this pull request, make a commit to your master/trunk branch
with (at least) the following in the commit message:
This closes #46
----
commit 53938e14a860bfd46b1dabbbcba168ae5517a04b
Author: vladbailescu <ba...@adobe.com>
Date: 2014-11-20T11:43:20Z
SLING-4177 - Added escaping for styleString context
* added a new method for style string escaping to XSS API
* added implementation and tests
* added string escaping in Sightly for styleString context
----
> Sightly: StyleString context doesn't properly escape
> ----------------------------------------------------
>
> Key: SLING-4177
> URL: https://issues.apache.org/jira/browse/SLING-4177
> Project: Sling
> Issue Type: Bug
> Components: Scripting
> Reporter: Vlad Bailescu
> Priority: Minor
> Labels: Sightly
> Fix For: Scripting Sightly Engine 1.0.0
>
>
> The {{context='styleString'}} expression option seems to escape strings the same way as {{context='scriptString'}}, but this breaks the string, making that context unusable. CSS strings are to be escaped {{\HH}} and not {{\xHH}} like in JS:
> https://developer.mozilla.org/en-US/docs/Web/CSS/string
> Consider following example:
> {code:html}
> <style>
> .ft:after { content: "${'\'' @ context='styleString'}"; }
> .in:after { content: "${'\"' @ context='styleString'}"; }
> </style>
> {code}
> Which currently gets incorrectly rendered as follows:
> {code:html}
> <style>
> .ft:after { content: "\x27"; }
> .in:after { content: "\x22"; }
> </style>
> {code}
> Following output would have been expected:
> {code:html}
> <style>
> .ft:after { content: "\27"; }
> .in:after { content: "\22"; }
> </style>
> {code}
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)