xss filter_attributes doesn't work as intended

[validatorjs]

xss filter_attributes doesn't work as intended

[lemonad]

Oh, I can totally submit a patch if I just get pointed in the right direction in terms of what filter_attributes() was meant to do.

[chriso]

It's a port of CodeIgniter's xss_clean() helper. My preg to RegExp skills weren't great when I ported it ;)

It looks like the function removes Javascript comments embedded in attribute values before removing common attack vectors like javascript: on this line.

[lemonad]

Thanks for the quick response! It still doesn't look quite right to me: the use of comments seems to have be left over from a previous commit?

[chriso]

Yeah rushed it a bit. I also split out the first regexp in to one for each quote so that the lazy .*? doesn't choke on something like href="alert('foo');". I'll write test cases when I get some time

[lemonad]

Looks like this issue is back again, identical to when I reported it. Should I open a new issue or can we reopen this?

[chriso]

Ok so I've changed the semantics a bit: if an offending attribute is found the whole thing is removed rather than just the evil pattern that was matched.