News for hackers. Stuff that matters.

A comment on Another flaw in Signal desktop app leaks chats in plaintext. Parent comment

Re:Another flaw in Signal desktop app leaks chats in plaintext by hawkice on Friday May 18, 2018 @02:15AM (#17099097)
The first one doesn't escape single quotes or slash, but I have no idea how to get any HTML parser to treat just those as anything but text. Underscore's implementation will be correct, I'm sure.
[ Parent | on HN ]
Re:Another flaw in Signal desktop app leaks chats in plaintext by codedokode on Friday May 18, 2018 @05:20AM (#17099907)
Slash doesn't need to be encoded. Only 5 characters that have special meaning have to be encoded (&, <, >, " and ').
[ Parent | on HN ]
Re:Another flaw in Signal desktop app leaks chats in plaintext by hawkice on Friday May 18, 2018 @05:39AM (#17100006)
Which raises the best question: how would you exploit someone not escaping single quotes? I do not know. Perhaps it isn't possible.
[ Parent | on HN ]
Re:Another flaw in Signal desktop app leaks chats in plaintext by jscissr on Friday May 18, 2018 @06:27AM (#17100257)
I think escaping quotes only matters for attributes (which can use ' or "). Example:

    <img src="$url">
Exploit:

    foo.jpg" onload="alert('pwned')
[ Parent | on HN ]
Re:Another flaw in Signal desktop app leaks chats in plaintext by kuroguro on Friday May 18, 2018 @09:05AM (#17101100)
Heh, found the exact bug on a live bbcode parser some 5 years ago.
[ Parent | on HN ]
Re:Another flaw in Signal desktop app leaks chats in plaintext by codedokode on Friday May 18, 2018 @05:45PM (#17105205)
It was probably written using regexps? One should make full syntax analysis instead of writing regexp hacks.
[ Parent | on HN ]