284161 - HTML parser allows NUL characters in attribute values

Status: RESOLVED FIXED

(Core :: DOM: HTML Parser, defect)

Description

[Blake Kaplan (:mrbkap) (inactive)]

We currently allow NUL characters in quite a few places in parser code that we
probably shouldn't. In the testcase in the URL, there are NUL values in the
"value" attribute of the text fields, which messes things up (both in
view-source and in the actual page). Fixing the issue on this page should be as
simple as putting a couple of StripChar()s in CAttributeToken::SanitizeValue()
and CAttributeToken::Consume().

I'm open to other suggestions, especially ones that will solve this more
globally (i.e., not just for attributes).

Comment 1

[Johnny Stenback (:jst)]

I seem to remember there beeing a bug that was about specifically allowing null
characters in HTML content, including attributes. I could be wrong, that was
many years ago...

Comment 2

[Mike Kaply [:mkaply]]

Attachment: Testcase