zeroclipboard/zeroclipboard — pull request #335 by jonrohan (2014-01-31 17:42:23+00:00)
Title: [XSS Vulnerability] Using a replace function for sanitizing the string

@masatokinugawa was so kind to email us about a security vulnerability.

Here's what he said.

```
PoC:
http://zeroclipboard.org/javascripts/zc/ZeroClipboard_1.3.1.swf?jsModuleId=%ED%A0%80\"))}catch(e){alert(1)}//

This XSS is brought by Flash's bug. It seems that Flash Player can't
treat the high surrogate character (U+D800 - U+DBFF) properly.

You can see this buggy behavior from the following URL:
http://vulnerabledoma.in/flash_surrogate_test.swf?q=%ED%A0%80\abc
(The source code is here: http://vulnerabledoma.in/flash_surrogate_test.as )

"q" parameter is set to "[U+D800]\abc". [U+D800] ( %ED%A0%80 ) is high
surrogate.
The displayed results is:

loaderInfo.parameters["q"] returns "[U+FFFD]abc"
loaderInfo.parameters["q"].split("\").join("\\") returns "[U+FFFD]\abc"
```

This pull implements his suggestion of using a `replace(/\\/g,"\\\\")` instead of `split("\").join("\\")`

@JamesMGreene @ptoomey3 @jnewland @mastahyeti