| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| | |
|
| | |
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Escaped HTML characters vary in length. So, in order to select the
correct replacement two variables need to be loaded: The pointer to the
new substring and its length. Because of this the generated code is less
dense than it could be.
With this PR instead of selecting the appropriate `&str`, an `&&str` is
selected. The former consumes two words while the latter consumes only
one. Intuitively one might assume that the double dereference makes the
code slower, but the optimized lookup seems to be so much faster, so
that the change is worth its weight.
Comparing the result of `cargo bench` (best out of three runs for both):
```text
Old: [4.3592 µs 4.3675 µs 4.3764 µs]
New: [3.8691 µs 3.8766 µs 3.8860 µs]
Diff: [-11.24 % -11.24 % -12.21 % ]
```
|
| | |
|
| |
|
|
|
|
|
|
|
|
|
|
| |
Using only safe code is actually same as fast as the previous "unsafe"
code according to the crate's benchmark.
The code was extracted from [markup]'s escape function in [escape.rs],
written by Utkarsh Kukreti <utkarshkukreti@gmail.com>, licensed as
`MIT OR Apache-2.0`.
[markup]: https://crates.io/crates/markup
[escape.rs]: https://github.com/utkarshkukreti/markup.rs/blob/8ec40428483790b2c296e907e7be4147b157fe8f/markup/src/escape.rs#L1-L21
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Previously the built-in json filter had an issue that made it unsafe to
use in HTML data. When used in HTML attributes an attacker who is able
to supply an arbitrary string that should be JSON encoded could close
the containing HTML element e.g. with `"</div>"`, and write arbitrary
HTML code afterwards as long as they use apostrophes instead of
quotation marks. The programmer could make this use case safe by
explicitly escaping the JSON result: `{{data|json|escape}}`.
In a `<script>` context the json filter was not usable at all, because
in scripts HTML escaped entities are not parsed outside of XHTML
documents. Without using the safe filter an attacker could close the
current script using `"</script>"`.
This PR fixes the problem by always escaping less-than, greater-than,
ampersand, and apostrophe characters using their JSON unicode escape
sequence `\u00xx`. Unless the programmer explicitly uses the safe
filter, quotation marks are HTML encoded as `"`. In scripts the
programmer should use the safe filter, otherwise not.
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
This was based off of the OWASP XSS prevention cheat sheet --
https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html#output-encoding-rules-summary
However, there isn't really any attack vector based on forward slash alone, and
it's being removed in the next version of that document.
> There is no proof that escaping forward slash will improve
> defense against XSS, if all other special characters are escaped
> properly, but it forces developers to use non-standard implementation of
> the HTML escaping, what increases the risk of the mistake and makes the
> implementation harder.
https://github.com/OWASP/CheatSheetSeries/pull/516
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| |
|
|
|
|
| |
* Improved rendering time
* Fix useless codes
|
| | |
|
| |
|
Dirkjan Ochtman
René Kijewski
René Kijewski
Alex Wennerberg
Wim Looman
Ciprian Dorin Craciun
Ram Kaniyur
yossyJ
bott