Mirrors
/
noscript
mirror of https://github.com/hackademix/noscript.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

[XSS] Fixed escape detection bug causing strage false positives (thanks Dave Howorth for report).

This commit is contained in:
hackademix 2020-09-10 00:30:34 +02:00
parent b79067c745
commit 888a284f58
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/xss/InjectionChecker.js
View File

@ -306,7 +306,7 @@ XSS.InjectionChecker = (async () => {
'\\.' + IC_COMMENT_PATTERN + "src" + IC_COMMENT_PATTERN + '=' + '\\.' + IC_COMMENT_PATTERN + "src" + IC_COMMENT_PATTERN + '=' +
IC_EVENT_DOS_PATTERN + IC_EVENT_DOS_PATTERN +
"|\\b" + fuzzify("onerror") + "\\b[^]*=" + "|\\b" + fuzzify("onerror") + "\\b[^]*=" +
"|=[s\\\\[ux]?\d{2}" + // escape (unicode/ascii/octal) "|=\\\\[ux]?\\d{2}" + // escape (unicode/ascii/octal)
"|\\b(?:toString|valueOf)\\b" + IC_COMMENT_PATTERN + "=[^]*(?:" + IC_EVAL_PATTERN + ")" + "|\\b(?:toString|valueOf)\\b" + IC_COMMENT_PATTERN + "=[^]*(?:" + IC_EVAL_PATTERN + ")" +
"|(?:\\)|(?:[^\\w$]|^)[$a-zA-Z_\\u0ff-\\uffff][$\\w\\u0ff-\\uffff]*)" + IC_COMMENT_PATTERN + '=>' + // concise function definition "|(?:\\)|(?:[^\\w$]|^)[$a-zA-Z_\\u0ff-\\uffff][$\\w\\u0ff-\\uffff]*)" + IC_COMMENT_PATTERN + '=>' + // concise function definition
"|(?:[^\\w$]|^)" + IC_EVENT_PATTERN + IC_COMMENT_PATTERN + "=" "|(?:[^\\w$]|^)" + IC_EVENT_PATTERN + IC_COMMENT_PATTERN + "="