Hacker News Reader

Hacker News

Comment by ddtaylor | Hacker News Reader

Full thread

ddtaylor

I don't know if this is exploitable, but they are using many different methods to escape HTML content:

https://github.com/signalapp/Signal-Desktop/blob/d1f7f5ee8c1...

Then here it's a different function:

https://github.com/signalapp/Signal-Desktop/blob/d1f7f5ee8c1...

Then sometimes they use the underscore library to do it:

https://github.com/signalapp/Signal-Desktop/blob/d1f7f5ee8c1...

Which their implementation seems to be using regular expressions as well.

View on HN

It looks like those are 3 separate third-party libraries (Mocha, Mustache, and Backbone), so each doing HTML escaping a bit differently shouldn't be too surprising.

The first one doesn't escape single quotes or slash, but I have no idea how to get any HTML parser to treat just those as anything but text. Underscore's implementation will be correct, I'm sure.

Slash doesn't need to be encoded. Only 5 characters that have special meaning have to be encoded (&, <, >, " and ').

Which raises the best question: how would you exploit someone not escaping single quotes? I do not know. Perhaps it isn't possible.

I think escaping quotes only matters for attributes (which can use ' or "). Example:

    <img src="$url">

Exploit:

    foo.jpg" onload="alert('pwned')

Heh, found the exact bug on a live bbcode parser some 5 years ago.

It was probably written using regexps? One should make full syntax analysis instead of writing regexp hacks.

Reply on news.ycombinator.com