RE: [EXT] AW: HTML encoder

Hi,

After further investigation, this was a false positive from a vulnerability scanner.

Thanks for the help though. :)

KR,
Phil

From: Karsten Kusche <[email protected]>
Sent: Wednesday, January 12, 2022 12:40 PM
To: Philippe Demaecker <[email protected]>; [email protected]
Subject: [EXT] AW: HTML encoder


Warning: This is an external email. Do not click on links or open attachments unless you recognize the sender and know the content is safe.
Hi Phil,

The most secure way is using Seaside's canvas:
WAHtmlCanvas builder render:[:r | r text: myString]

If you want to use the encoded string as part of other HTML, don't! Instead generate your HTML using Seaside's canvas. Correctly encoding in HTML is damn difficult and there's a difference if your string is used as attribute value (<a attr="foo">) or as text between elements (<a>foo</a>). If you want to be save, use the canvas!

Alternatively you can use XML.Text (e.g. XML.Text text:'<abc>'), its printString will be correct xml (it'll not use HTML entities though).

Kind Regards
Karsten
Von: Philippe Demaecker [mailto:[email protected]]
Gesendet: Mittwoch, 12. Januar 2022 12:15
An: [email protected]<mailto:[email protected]>
Betreff: [vwnc] HTML encoder

Hi list,

I'm looking for a piece of code that will convert a string to its HTML encoded equivalent.

Input: <script>alert(1)</script>
Ouput: &lt;script&gt;alert&lpar;1&rpar;&lt;&sol;script&gt;

(Or: https://urldefense.com/v3/__https://gchq.github.io/CyberChef/*recipe=To_HTML_Entity(false,'Named*20entities')&input=PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg__;IyU!!DZ3fjg!oObSUaq7nj9b2OTsB_Pgzge2nKYm3ZZr7bDBoMyY9S91lip1L3wAez0CpC7hLYd5i0obi-Q$ <https://urldefense.com/v3/__https:/gchq.github.io/CyberChef/*recipe=To_HTML_Entity(false,'Named*20entities')&input=PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg__;IyU!!DZ3fjg!u449TzBNRX-iDgMuIVq_ZiHgLMU3o2OLQSszE_VyPPrTzx72g5mbpe0JIfRqtNoq2fr3ME0$>)

I searched the code and list, but no luck.

Any ideas?

Thanks,
Phil