wandenberg/nginx-push-stream-module — Issue #16: escaping (XSS) bug in stream mode
Author: adamgundy
Created: 2012-02-17 19:49:59+00:00
State: open

if the character ' (apostrophe) is used as part of the payload (or the channel name.. much less likely), and pushstream is working in stream mode, you will get a javascript error on the client.

the issue is that in stream mode (and only stream mode!), the payload is pushed to the client using a javascript function call, like this:

the ' is not escaped (ie: \') and so it is interpreted as the end of the string argument.

this is trivial to demonstrate - go to the demo chat page using IE, and enter some text with a ' in it. you will get a javascript error.