Bug Tracker

Modify ↓

Ticket #6429 (closed bug: wontfix)

Opened 3 years ago

Last modified 3 years ago

Selector problem: elements with "<" and ">" with backslash escaping aren't selected

Reported by: mriver Owned by:
Priority: undecided Milestone: 1.4.3
Component: selector Version: 1.4.2
Keywords: selector escape meta character Cc:
Blocking: Blocked by:

Description

According with official API reference, I escaped "<" and ">" characters in jQuery selector block. As expected "#foo>" and "#<bar" are selected, but "#<buz>" isn't. Mysteriously, "#>qux<" is selected correctly.

This would be replicated in following code: 

<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Strict//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd'>
<html xmlns='http://www.w3.org/1999/xhtml' xml:lang='en'>
<head>
    <meta http-equiv='Content-Type' content='text/html;charset=UTF-8' />
    <script type='text/javascript' src='http://ajax.googleapis.com/ajax/libs/jquery/1.4/jquery.js'></script>
    <title>Selector Escaping</title>
    <script type='text/javascript'>
    //<![CDATA[
        $(function(){
           $('#foo\\>').css('background', '#99ff99');       // OK
           $('#\\<bar').css('background', '#99ff99');       // OK
           $('#\\<buz\\>').css('background', '#99ff99');    // NG
           $('#\\>qux\\<').css('background', '#99ff99');    // OK
        });
    //]]>
    </script>
</head>
<body>    
    <div id='foo&gt;'>#foo&gt;</div>
    <div id='&lt;bar'>#&lt;bar</div>
    <div id='&lt;buz&gt;'>#&lt;buz&gt;</div>
    <div id='&gt;qux&lt;'>#&gt;qux&lt;</div>
</body>
</html>

Change History

comment:1 Changed 3 years ago by dmethvin

  • Priority set to undecided
  • Status changed from new to closed
  • Resolution set to wontfix

This is due to the documented behavior of the jQuery() method.

If a string is passed as the parameter to $(), jQuery examines the string to see if it looks like HTML (i.e., it has <tag ... > somewhere within the string). If not, the string is interpreted as a selector expression, as explained above. --  http://api.jquery.com/jQuery/#jQuery2

This case looks more like an exploit than a legitimate page. ID attributes can't contain either < or > characters.

 http://jsfiddle.net/dmethvin/wpkBJ/

Please follow the  bug reporting guidlines and use  jsFiddle when providing test cases and demonstrations instead of pasting the code in the ticket.

View ↑

Add a comment

Modify Ticket

Action
as closed
Author


E-mail address and user name can be saved in the Preferences.

Attachments ↑
 
Note: See TracTickets for help on using tickets.