Illegal attributes that begin with = #2143

paj28 · 2024-06-15T08:25:32Z

If we parse an attribute like <test =foo=bar/> Then in the DOM the attribute appears with the = sign, but when re-serialized it is generated without.

Code:

val doc = Jsoup.parse("<test =foo=\"bar\"/>")
for (elem in doc.select("test")) {
    for (attr in  elem.attributes()) {
        println(attr.key)
    }
}
println(doc.html())

Output:

=foo
<html>
 <head></head>
 <body>
  <test foo="bar" />
 </body>
</html>

This is problematic as if an application is doing validation on the key, to prevent XSS attacks, this can be a way to bypass the validation. I discovered this issue (in a lab environment, not a live app) just now.

The key for output can be accessed using getValidKey(). A potential solution to this is to normalise keys during parsing.

The text was updated successfully, but these errors were encountered:

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Illegal attributes that begin with = #2143

Illegal attributes that begin with = #2143

paj28 commented Jun 15, 2024

Illegal attributes that begin with = #2143

Illegal attributes that begin with = #2143

Comments

paj28 commented Jun 15, 2024