Small enhancement to escape:javascript

Hi!

As said in XHTML 1.0 / HTML Compatibility Guidelines / Embedded Style Sheets and Scripts
http://www.w3.org/TR/xhtml1/#C_4
strings < or & or ]]> or -- are not recommended in embedded scripts.

'<', '>' and '&' are prohibited if script section is not properly marked as CDATA.

At least '<' is not good for old HTML too (basically, in '</script>' string).

So, I think it is good to escape '<','>','&','--' properly in javascript-escaped strings

Konstantin Pelepelin


Proposed patch: 
========== begin
diff -u -b -r1.23 modifier.escape.php
--- modifier.escape.php 23 Nov 2005 20:36:05 -0000      1.23
+++ modifier.escape.php 26 May 2006 09:44:07 -0000
@@ -62,7 +62,8 @@

         case 'javascript':
             // escape quotes and backslashes, newlines, etc.
-            return strtr($string, array('\\'=>'\\\\',"'"=>"\\'",'"'=>'\\"',"\r"=>'\\r',"\n"=>'\\n','</'=>'<\/'));
+            return strtr($string, array('\\'=>'\\\\',"'"=>"\\'",'"'=>'\\"',"\r"=>'\\r',"\n"=>'\\n',
+                        '<'=>'\\074','>'=>'\\076','&'=>'\\046','--'=>'\\055\\055'));

         case 'mail':
             // safe way to display e-mail address on a web page
========== end

Complicated test example:
========== begin
{assign var='any_user_data' value='malicious </script><script>window.alert("malicious!")</script>'}
{capture assign='onclick'}
window.alert('{$any_user_data|escape:'javascript'}');return false;
{/capture}
{capture assign='html'}
<a href="#" onclick="{$onclick|escape}">click!</a>
{/capture}
<script language="JavaScript" type="text/javascript">
document.write('{$html|escape:'javascript'}');
</script>
========== end

-- 
Smarty Development Mailing List (http://smarty.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php