Attribute quoting with backquotes in HTML::Parser

Good day!

I searched the archives and didn't find anything. Were there
discussions about supporting weird IE quoting with backquotes
()?

It seems that IE7 continues to implement it so HTML::Parser should
probably too at least with a non-default option.

Currently, it is parsed as .

What are the thoughts? Backquotes are mostly used in XSS exploits
nowadays and I have a hard time dealing with such attacks using
HTML::Parser.

--
Alex Kapranoff.

Re: Attribute quoting with backquotes in HTML::Parser

On 2/6/07, Alex Kapranoff wrote:
> Good day!
>
> I searched the archives and didn't find anything. Were there
> discussions about supporting weird IE quoting with backquotes
> ()?

I never heared a request for that before so I don't think so.

> It seems that IE7 continues to implement it so HTML::Parser should
> probably too at least with a non-default option.
>
> Currently, it is parsed as .
>
> What are the thoughts? Backquotes are mostly used in XSS exploits
> nowadays and I have a hard time dealing with such attacks using
> HTML::Parser.

It seems kind of harmless (and easy) to support this so I'm not oposing it.
What "rules" do IE follow when it can't find the matching ending backquote?

--
Gisle Aas

Re: Attribute quoting with backquotes in HTML::Parser

* Gisle Aas [February 06 2007, 18:41]:
> On 2/6/07, Alex Kapranoff wrote:
> >Good day!
> >
> >I searched the archives and didn't find anything. Were there
> >discussions about supporting weird IE quoting with backquotes
> >()?
>
> I never heared a request for that before so I don't think so.
>
> >It seems that IE7 continues to implement it so HTML::Parser should
> >probably too at least with a non-default option.
> >
> >Currently, it is parsed as .
> >
> >What are the thoughts? Backquotes are mostly used in XSS exploits
> >nowadays and I have a hard time dealing with such attacks using
> >HTML::Parser.
>
> It seems kind of harmless (and easy) to support this so I'm not oposing it.
> What "rules" do IE follow when it can't find the matching ending backquote?

Looks like it doesn't stop at either double or single quote and eats
all the document into the attribute. If there's no closing backquote
or closing angle in the parent tag, the tag is skipped and the parsing
restarts at the next opening angle.

I could not find differences between "backquoting" and normal quoting
with " or '.

--
Alex Kapranoff.