HTML Standard Tracker

Diff (omit for latest revision)
Filter

Short URL: http://html5.org/r/4076

File a bug

SVNBugCommentTime (UTC)
4076[Authors] [Conformance Checkers] Disallow ` in unquoted attribute values.2009-10-05 03:31
Index: source
===================================================================
--- source	(revision 4075)
+++ source	(revision 4076)
@@ -76761,10 +76761,40 @@
     characters</span>, any U+0022 QUOTATION MARK (<code>&#x22;</code>)
     characters, U+0027 APOSTROPHE (<code>&#x27;</code>) characters,
     U+003D EQUALS SIGN (<code>=</code>) characters, U+003C LESS-THAN
-    SIGN (<code>&lt;</code>) characters, or U+003E GREATER-THAN SIGN
-    (<code>&gt;</code>) characters, and must not be the empty
-    string.</p>
+    SIGN (<code>&lt;</code>) characters, U+003E GREATER-THAN SIGN
+    (<code>&gt;</code>) characters, or U+0060 GRAVE ACCENT (`)
+    characters, and must not be the empty string.</p>
 
+    <!-- The ` character is in this list on a temporary basis, waiting
+         for IE to fix it's parsing bug whereby it treats ` as an
+         attribute value delimiter. Otherwise, escaping software that
+         tries to be clever and not use quotes when it doesn't need to
+         could be tricked by an attacker.
+
+         Posit a site that allows the user to input text that is used
+         verbatim in two attributes, such that the user can set the
+         first attribute's value to:
+
+            `
+
+         ...and the second to:
+
+            ` onload='...payload...' end=x
+
+         ...with the assumption that the site is going to not quote
+         the first one, and quote the second one with double quotes:
+
+            <body title=` class="` onload='...payload...' end=x">
+
+         In IE, this is treated as:
+
+            <body title=' class="'
+                  onload='...payload...'
+                  end='x"'>
+
+    -->
+
+
     <div class="example">
 
      <p>In the following example, the <code
@@ -79153,6 +79183,7 @@
 
    <dt>U+003C LESS-THAN SIGN (&lt;)</dt>
    <dt>U+003D EQUALS SIGN (=)</dt>
+   <dt>U+0060 GRAVE ACCENT (`)</dt>
    <dd><span>Parse error</span>. Treat it as per the "anything else"
    entry below.</dd>
 
@@ -79248,6 +79279,7 @@
    <dt>U+0027 APOSTROPHE (')</dt>
    <dt>U+003C LESS-THAN SIGN (&lt;)</dt>
    <dt>U+003D EQUALS SIGN (=)</dt>
+   <dt>U+0060 GRAVE ACCENT (`)</dt>
    <dd><span>Parse error</span>. Treat it as per the "anything else"
    entry below.</dd>
 

|