[ ijbswa-Bugs-2976092 ] img-reorder breaks http://www.bmo.com/home

Bugs item #2976092, was opened at 2010-03-24 12:18
Message generated for change (Comment added) made by ned14
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=111118&aid=2976092&group_id=11118

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: funct: filtering
Group: version 3.0.16
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: Nobody/Anonymous (nobody)
Assigned to: Nobody/Anonymous (nobody)
Summary: img-reorder breaks http://www.bmo.com/home

Initial Comment:
The img-reorder filter breaks http://www.bmo.com/scripts/bmo_common.js

This was reported at http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=575292

Here is a unified diff between the good (not passed through privoxy) and bad (passed through privoxy) files.

--- GOOD-bmo_common.js	2010-03-23 08:25:41.000000000 -0400
+++ BAD-bmo_common.js	2010-03-24 14:48:11.000000000 -0400
@@ -220,9 +220,9 @@
 	var menu = "";	
 		
 	// Create Menu
-	menu += '<a href="javascript:setDefaultFontSize(\'small\');" title="Small"><img id="small_textIcon" src="'+baseFileURL()+'images/smText_' + ((currentFontSize == "small") ? "on" : "off") + '.gif" alt="Small Text" class="textSizeIcon"></a>';
-	menu += '<a href="javascript:setDefaultFontSize(\'medium\');" title="Medium"><img id="medium_textIcon" src="'+baseFileURL()+'images/medText_' + ((currentFontSize == "medium") ? "on" : "off") + '.gif" alt="Medium Text" class="textSizeIcon"></a>';
-	menu += '<a href="javascript:setDefaultFontSize(\'large\');" title="Large"><img id="large_textIcon" src="'+baseFileURL()+'images/bgText_' + ((currentFontSize == "large") ? "on" : "off") + '.gif" alt="Large Text" class="textSizeIcon"></a>';	
+	menu += '<a href="javascript:setDefaultFontSize(\'small\');" title="Small"><img src="'+baseFileURL()+'images/smText_' + ((currentFontSize == " id="small_textIcon"small") ? "on" : "off") + '.gif" alt="Small Text" class="textSizeIcon"></a>';
+	menu += '<a href="javascript:setDefaultFontSize(\'medium\');" title="Medium"><img src="'+baseFileURL()+'images/medText_' + ((currentFontSize == " id="medium_textIcon"medium") ? "on" : "off") + '.gif" alt="Medium Text" class="textSizeIcon"></a>';
+	menu += '<a href="javascript:setDefaultFontSize(\'large\');" title="Large"><img src="'+baseFileURL()+'images/bgText_' + ((currentFontSize == " id="large_textIcon"large") ? "on" : "off") + '.gif" alt="Large Text" class="textSizeIcon"></a>';	
 
 	// Output Menu to Screen
 	document.getElementById('fontSizeMenu').innerHTML = menu;

Although Debian does not ship 3.0.16, I tested it against 3.0.16's implementation of img-reorder.

Regards,

David F. Skoll <[email protected]>


----------------------------------------------------------------------

Comment By: Niall Douglas (ned14)
Date: 2012-07-20 09:28

Message:
Found the same problem with
http://securecdn.disqus.com/1342740678/build/system/embed.js where when
reordering a src attribute it breaks the Javascript's correctness.

Would there not be some way of getting the filter to ignore any embedded
javascript?

----------------------------------------------------------------------

Comment By: Fabian Keil (fabiankeil)
Date: 2010-03-28 11:27

Message:
Thanks for the report.

The only option I see here is disabling the filter for URLs ending in .js
and content delivered with a content type that looks like JavaScript.

This would still mean the filter could break embedded JavaScript with the
problematic pattern you found, but modifying it to properly understand
JavaScript doesn't sound like a realistic goal to me.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=111118&aid=2976092&group_id=11118

------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/