SELECTOR INTERPRETED AS HTML : ticket - 11290

[parthasarathi.g@…]

ticket - 11290 is still possible in latest versions and this leads to xss vulnerability too.

​http://jsfiddle.net/C8dgG/27/

[gibson042]

The provided example has two problems:

• Inclusion of raw <script>…</script> breaks the resultant HTML
• element[attribute='<script>alert(1);</script><img src='sss' onerror='alert(1)'><b>zzz</b>'] is not a valid selector (the string against which to test "attribute" is closed immediately before "sss")

Fixing both problems demonstrates the lack of a vulnerability: ​http://jsfiddle.net/C8dgG/28/

However, fixing just the first reveals a parsing error in Sizzle: ​http://jsfiddle.net/C8dgG/29/

I will open a new ticket for the latter.