1941347 - Escape "<" and ">" in attributes when serializing HTML

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, task)

Description

[Simon Pieters [:zcorpan] (OOO until Aug 4)]

See https://github.com/whatwg/html/issues/6235

Chromium is doing a staged rollout of this, currently at 1%, and haven't found compat problems so far.

We should implement this as well, since it helps to mitigate mutation XSS (mXSS) attacks.

Comment 1

[Frederik Braun [:freddy]]

Now at 3% :)

Comment 2

[Tom Schuster (MoCo)]

Attachment: Bug 1941347 - Escape "<" and ">" in attributes when serializing HTML. r?#dom-core-reviewers

Comment 3

[Tom Schuster (MoCo)]

I am only modifying nsContentUtils::SerializeNodeToMarkup here. We have some older serializers based on nsIContentSerializer, which as far as I can tell already escape < and >, at least when escaping at all.

nsXMLContentSerializer::AppendAndTranslateEntities seems to escape it, which is also used for nsXHTMLContentSerializer::AppendAndTranslateEntities unless all entity encoding is disabled.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/d176c8bbf229
Escape "<" and ">" in attributes when serializing HTML. r=dom-core,devtools-reviewers,nchevobbe,hsivonen

Comment 5

[Narcis Beleuzu [:NarcisB]]

https://hg.mozilla.org/mozilla-central/rev/d176c8bbf229

Comment 6

[Hamish Willee]

FF139 MDN docs work for this can be tracked in https://github.com/mdn/content/issues/39309

Comment 7

[Frederik Braun [:freddy]]

The pref is Nightly-only, isn't it?

Comment 8

[Hamish Willee]

The pref is Nightly-only, isn't it?

That's how it looks and how I have documented it

+# Serialize < as < and > as > in attribute values for getHTML, innerHTML etc.
+- name: dom.security.html_serialization_escape_lt_gt

• type: RelaxedAtomicBool
• value: @IS_NIGHTLY_BUILD@
• mirror: always