XSS injection vulnerability using empty, undelimited attributes

[jimmed]

Entering the following:

<IMG SRC= onmouseover="alert('XSS');">

produces the following:

<img src="onmouseover="alert('XSS');"" />

This is definitely invalid HTML, but would suggest that it's being interpreted incorrectly by the parser. I would expect:

<img src="" />

[boutell]

Hmm, is this a bug in HTMLParser2?

On Thu, Jul 17, 2014 at 10:45 AM, jimmed notifications@github.com wrote:

Entering the following:

<IMG SRC= onmouseover="alert('XSS');">

produces the following:

<img src="onmouseover="alert('XSS');"" />

This is definitely invalid HTML, but would suggest that it's being
interpreted incorrectly by the parser. I would expect:

—
Reply to this email directly or view it on GitHub
#19.

*THOMAS BOUTELL, *DEV & OPS
P'UNK AVENUE | (215) 755-1330 | punkave.com

[boutell]

I am surprised that this doesn't show up as two attributes in the data
we're getting from the parser.

One way we can deal, though, is by making sure there are no unescaped
double quotes allowed to come through in an attribute.

On Thu, Jul 17, 2014 at 11:06 AM, Tom Boutell tom@punkave.com wrote:

Hmm, is this a bug in HTMLParser2?

On Thu, Jul 17, 2014 at 10:45 AM, jimmed notifications@github.com wrote:

Entering the following:

<IMG SRC= onmouseover="alert('XSS');">

produces the following:

<img src="onmouseover="alert('XSS');"" />

This is definitely invalid HTML, but would suggest that it's being
interpreted incorrectly by the parser. I would expect:

—
Reply to this email directly or view it on GitHub
#19.

*THOMAS BOUTELL, *DEV & OPS
P'UNK AVENUE | (215) 755-1330 | punkave.com

*THOMAS BOUTELL, *DEV & OPS
P'UNK AVENUE | (215) 755-1330 | punkave.com

[jimmed]

Closed this issue, see pull request #20