HedgerWow

{ 6 }

Comments

1. Peter Goodman | 02-Jan-08 at 10:05 pm | Permalink

   It seems to screw up on:
   eval(”alert(’hello world’);”);

   producing:
   SANDBOX_eval(”alert(’SANDBOX_hello SANDBOX_world’);”);

   Also, it fails to stop the following possible exploit (for IE):
   //@cc_on eval(”alert(’hello world’);”)

   Otherwise, very cool!

2. hedgerwang | 03-Jan-08 at 11:53 am | Permalink

   Thanks, it’s fixed now

3. Peter Goodman | 03-Jan-08 at 4:59 pm | Permalink

   I have found another hole:

   (”".prototype = function() {
   this[”eval”](”alert(’hello world.’)”);
   })();

   Unless of course, when it displays the around a string that means something. Also, if a normal variable ‘prototype’ is used, it is not filtered.

4. Peter Goodman | 03-Jan-08 at 5:17 pm | Permalink

   Here is a less convoluted example:

   (function(){
   // ‘this’ is the window object
   alert(this);
   })();

5. hedger | 03-Jan-08 at 7:15 pm | Permalink

   Thank Peter, I had written my codes and your codes should be handled correctly now.

   Please keep me posted if you find any malicious codes.

   :-D

6. Peter Goodman | 14-Jan-08 at 8:46 pm | Permalink

   There seems to be a problem when dealing with inline regular expressions where it treats everything with / and / as normal variables.

Post a Comment