Skip to content

Instantly share code, notes, and snippets.

@mala
Forked from anonymous/jq_quickpatch.html
Created June 26, 2011 03:13
Show Gist options
  • Star 1 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save mala/1047182 to your computer and use it in GitHub Desktop.
Save mala/1047182 to your computer and use it in GitHub Desktop.
quick patch for jQuery selector XSS
<script type="text/javascript">
// http://ma.la/jquery_xss/
(function($){
var _init = $.fn.init;
$.fn.init = function(selector, context, rootjQuery){
// note: only block "#<img>", "a[href=<img onerror=...>]" still work.
if( typeof arguments[ 0 ] == "string" && /^#.*</.test( arguments[ 0 ] ) ){
throw new Error( "selector error" );
}
// console.log(arguments[0]);
return _init.apply(this, arguments);
};
$.fn.init.prototype = _init.prototype;
})(jQuery);
</script>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment