|
NullCharEscapes
cannot match protocol of an absolute URL via String.startsWith.
Null characters in URL can disguise protocols such as javascript:.EffectUnsanitized code can be embedded in comments, and conditional compilation might disable runtime assertions. BackgroundRFC 3986 allows the following characters in a URI scheme: scheme = ALPHA *( ALPHA / DIGIT / "+" / "-" / "." ) IE apparently allows, and silently removes, certain characters from URLs. Collin Jackson reports that unicode code point 65533 is one of those. The last 4 code points in 32b unicode are:
http://www.mozillazine.org/talkback.html?article=4078 talks about wider exploits due to null bytes %00 in URLs. AssumptionsURL html attribute not stripped of null characters, ORURLs not restricted to absolute urls with a whitelisted protocol ORURLs not normalized. VersionsIE Example<iframe src="java�script:alert(42)"></iframe> |
Sign in to add a comment