Instantly share code, notes, and snippets.
mala mala
- LINE
- japan
mala /jq_quickpatch.html
CreatedJune 26, 2011 03:13 — forked fromanonymous/jq_quickpatch.html
quick patch for jQuery selector XSS This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.Learn more about bidirectional Unicode characters
| <scripttype="text/javascript"> | |
| // http://ma.la/jquery_xss/ | |
| (function($){ | |
| var _init = $.fn.init; | |
| $.fn.init = function(selector, context, rootjQuery){ | |
| // note: only block "#<img>", "a[href=<img onerror=...>]" still work. | |
| if( typeof arguments[ 0 ] == "string" && /^#.*</.test( arguments[ 0 ] ) ){ | |
| throw new Error( "selector error" ); | |
| } | |
| // console.log(arguments[0]); |