Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

escape_html: stop encoding slash, change apostrophe encoding to ', better docs #662

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

escape_html: stop encoding slash, change apostrophe encoding to ', better docs #662

wants to merge 1 commit into from

Commits on Aug 25, 2021

  1. escape_html: stop encoding / as / (+ more) 

    The OWASP XSS cheat sheet is a very badly-written document that hasn’t
been maintained and still contains various errors that have lasted more
than a decade, in some cases despite them being pointed out. Also the
section being quoted here was being misapplied anyway (it’s only for
*text*, not for attribute values, and it therefore escapes *way* more
than is needed). The entire document urgently needs to be completely
rewritten, but they’re not doing it. Hence in part my removal of any
citation of it.

One recently exorcised ancient error is the recommendation to escape
slashes: <OWASP/CheatSheetSeries#515>. That
was *always* spurious, and I want it gone partly under the principle of
least encoding but mostly because I’m fed up with URLs being uglified in
this way.

I’ve also changed the escaping of ' from &#x27; to &apos;, because the
reason for avoiding &apos; is invalid (it was an accidental omission in
an early HTML5 spec, long since reinstated, and all user agents always
supported it).
    @chris-morgan
    chris-morgan authored Aug 25, 2021
    Configuration menu
    Copy the full SHA
    a5bc634 View commit details
    Browse the repository at this point in the history