Emoticons re-arm escaped HTML.

[cburschka]

Reproduce

Enter:

This is a <code>Test</code>.

Get

This is a <code>Test</code>.

Enter:

This is a <code>Test</code>. :P

Get

This is a Test.

Analysis

This is a somewhat devious side-effect of the jQuery replaceText module, and would probably do well in an Underhanded JavaScript contest.

1. When jQuery parses the original HTML, any character entities are unescaped inside the text nodes. This is by design - the entities are only intended to armor meta-characters in the serialized HTML code.
2. Inserting emoticon images via replaceText() requires those images to be entered as HTML which is then evaluated.
3. jquery.replaceText evaluates the WHOLE text node, including any (unescaped, but not evaluated) HTML code that may already be present.

Solution

Any replaceText(search, replace, textonly) call that does not set textonly to true MUST first be preceded by a replaceText() call that escapes '<' and '&', and then followed by a third replaceText() call that DOES set textonly to true while unescaping '<' and '&'. This is the only way to guarantee that only the newly added HTML code will be evaluated.

Security considerations

It appears possible to execute arbitrary Javascript. This is bad.

[cburschka]

The following patch closes this security flaw:

diff --git a/js/core/visual.js b/js/core/visual.js
index c8969c9..a426e4d 100644
--- a/js/core/visual.js
+++ b/js/core/visual.js
@@ -261,13 +261,15 @@ visual = {
             + config.markup.emoticons[set].codes[code]
             + '" title="' + code + '" alt="' + code + '" /><span class="emote-alt">' + code + '</span>';
     }
-    jq.add('*', jq).not('code, code *, a, a *').replaceText(this.emoticonRegex, function() {
+    jq.add('*', jq).not('code, code *, a, a *')
+      .replaceText(/[<&]/g, function(a) { return {'&': '&amp;', '<':'&lt;'}[a]; })
+      .replaceText(this.emoticonRegex, function() {
       for (var i = 1; i < Math.min(arguments.length-2, emoticonSets.length+1); i++) {
         if (arguments[i]) {
           return emoticonImg(emoticonSets[i-1], arguments[i]);
         }
       }
-    });
+    }).replaceText(/&(lt|amp);/g, function(a) { return {'&amp;': '&', '&lt;':'<'}[a]; }, true);
     if (!config.settings.markup.emoticons) {
       jq.find('img.emoticon').css({display:'none'}).next().css({display:'inline'});
     }