Skip to content

Instantly share code, notes, and snippets.

@simianarmy

simianarmy/rails_xss_gsub_crash

Created October 12, 2011 16:55
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save simianarmy/1281815 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save simianarmy/1281815 to your computer and use it in GitHub Desktop.
Download ZIP
rails_xss gsub bug
Raw
rails_xss_gsub_crash
str = ActiveSupport::SafeBuffer.new "<script>alert</script>"
CGI::unescapeHTML str
=>TypeError: can't dup NilClass
from /Users/marcm/.rvm/rubies/ree-1.8.7-2011.03/lib/ruby/1.8/cgi.rb:371:in `dup'
UnescapeHTML chokes b/c $1 = nil on line 371:
369 def CGI::unescapeHTML(string)
370 string.gsub(/&(amp|quot|gt|lt|\#[0-9]+|\#x[0-9A-Fa-f]+);/n) do
=> 371 match = $1.dup
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment