XSS and numeric code character entities

[validatorjs]

XSS and numeric code character entities

[boutell]

I just banged into this one as well.

[boutell]

The problem is in this line:

//Validate UTF16 two byte encoding (x00) - just as above, adds a semicolon if missing.
str = str.replace(/(&\#x?)([0-9A-F]+);?/i, '$1;$2');

[boutell]

Looks very cut and dried: the semicolon is just in the wrong place in the replacement.

Move it to the end and things work better. Look at the regular expression and notice that the semicolon it's looking for (and supplying if absent) is at the end, after both parenthesized clauses. So it's clear that it doesn't go between $1 and $2, but rather after both of them.

//Validate UTF16 two byte encoding (x00) - just as above, adds a semicolon if missing.
str = str.replace(/(&\#x?)([0-9A-F]+);?/i, '$1$2;');

[chriso]

Fixed in #79