chrisisbeef/jquery-encoder — pull request #6 by kmartinson (2013-06-14 08:05:37+00:00)
Title: Miscellaneous issues with jquery-encoder

Hello Chris,
I am using your jquery encoder. Many thanks for developing it!
We have done some unit testings and found some issues. I have made suggestions on how to correct them in this fork.

1) Which characters that are immune was random for javascript encoding,
in worst case it threw an exception. The problem is the global variable immune: it is used in encodeForHTMLAttribute, encodeForCSS and encodeForJavascript.
It is not initialized in encodeForJavascript, which leads to random behaviour,
it uses the same immune characters as previous function call, irrespective of which of the encoding functions that preceded this call, or even worse if not set earlier by someone else an exception is raised.
Solution: I just changed immune from being global to local.

2) Event handlers like onmouseover shouldn't be allowed to be encoded via
function encodeForHTMLAttribute, they should be encoded via encodeForJavascript.
The blacklist for attribute names contains a regular expression to identify them, on[a-z]{1,}, but the regular expression is not applied since inArray() in jQuery doesn’t support regular expressions. Note that the regexp is quite wide, for instance is NonExistingAttributeName a match.
Solution: Changed from inArray() to match().

3) Unsafe html attribute values were not searched for.
Solution: Length has to be added in order to execute the array iteration that searches for unsafe attribute values.

4) From the documentation of function canonicalize: "The default behavior of the method is to raise an exception if it detects one of these scenarios.". This refers to multiple or double encoding. But that is not the case, the default behaviour is to ignore a double encoding. Which behaviour is prefered?
The default behaviour is important, that one will be used when canonicalize() is called from the other encode functions.

I have extended your unit test to identify issue 1 to 3. If you test against jquery-encoder-0.1.0.js you will get three failures, which are corrected if you test against encoder.js.

Thanks Karin