Beefy Boxes and Bandwidth Generously Provided by pair Networks
Pathologically Eclectic Rubbish Lister
 
PerlMonks  

Comment on

( #3333=superdoc: print w/ replies, xml ) Need Help??
That will not adequately strip javascript.

Slashdot|MS Security: On A Path As Clear As It Is Reliable pointed me to Expert hacks Hotmail in 1 line of code which in turn pointed me here, which reveals that STYLE tags in netscape will execute the stuff enclosed in style tags as javascript, if the TYPE attribute of the style tag is "application/x-javascript".

Your code: 56: $str=~s/<script[^>]*>.*?<\/script[^>]*>//igs if $$USER{jsoff};

My addition (you're welcome to improve):

#!/usr/bin/perl -w use strict; my $string = q|<STYLE TYPE="application/x-javascript" Language='Englis +h' TYPE="application/x-javascript">|; printf "%s\n", $string; $string =~ s<STYLE\s([^>]*)> { my $trt = $1; # $trt =~ s!type=\S+?(\s|"|')!TYPE="text/css"!igs; $trt =~ s!type=\S+?[ '"]!TYPE="text/css"!igs; qq(<STYLE $trt>) }eigsx; printf "%s\n", $string;
Also evil are object, applet and embed tags (i'm sure there are others).

update: a slightly smarter version

#!/usr/bin/perl -w use strict; my $string = q|<STYLE TYPE="application/x-javascript" Language='Englis +h' TYPE="application/x-javascript">|; printf "%s\n", $string; $string =~ s<STYLE\s([^>]*>) { my $trt = $1; # $trt =~ s!type=\S+?(\s|"|')!TYPE="text/css"!igs; $trt =~ s!type=\S+?[ '">]!TYPE="text/css"!igs; $trt .= '>' if substr($trt,-1,1) ne '>'; qq(<STYLE $trt) }eigsx; printf "%s\n", $string;
update: OeufMayo says in the cb, what about: <a href="#" onClick="alert('evil javascript here');">

Well I thought htmlScreen would take care of it, but you do override the filter

$str.=htmlcode('parselinks','doctext,override'); ... in parselinks ... $text=htmlScreen($text,$APPROVED) unless $overridefilter eq "override" +;

 
___crazyinsomniac_______________________________________
Disclaimer: Don't blame. It came from inside the void

perl -e "$q=$_;map({chr unpack qq;H*;,$_}split(q;;,q*H*));print;$q/$q;"


In reply to (crazyinsomniac) Re: Turn JavaScript off on HomeNodes by crazyinsomniac
in thread Turn JavaScript off on HomeNodes by vroom

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post; it's "PerlMonks-approved HTML":



  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • Outside of code tags, you may need to use entities for some characters:
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.
  • Log In?
    Username:
    Password:

    What's my password?
    Create A New User
    Chatterbox?
    and the web crawler heard nothing...

    How do I use this? | Other CB clients
    Other Users?
    Others rifling through the Monastery: (3)
    As of 2014-09-20 03:43 GMT
    Sections?
    Information?
    Find Nodes?
    Leftovers?
      Voting Booth?

      How do you remember the number of days in each month?











      Results (152 votes), past polls