536837 - XSS on HTML wrapper methods

Status: RESOLVED DUPLICATE of bug 352437

(Core :: JavaScript Engine, defect)

Description

[Masahiro YAMADA]

JavaScript HTML wrapper methods [anchor(),link(),fontsize(),fontcolor()] does not escape HTML special characters.

for example,
"test2".fontcolor("blue\"><b>str<"+"/b>");
returns following string:
<font color="blue"><b>str2</b>">test2</font>

I think it is bug of web application.
There are tow reasons.
1.According to HTML specification, it is not needed to accept HTML special characters for <font size="XX">, <font color="XX">, <a name="XX"> and <a href="XX">
2.Web developers can replace them using DOM API.

But it is better to write some document for web developers to avoid XSS , or implement HTML escape.

# I think it is not needed to change current implementation.

Comment 1

[Jeff Walden [:Waldo]]

Old, arguably even an ill-advised feature (allows composition of some of the methods), in any case a duplicate.