Why is "<" escape encoded by rehype-stringify and how to disable? #51

sgpinkus · 2021-02-12T07:44:10Z

sgpinkus
Feb 12, 2021

Given this test code:

var unified = require('unified')
var html = require('rehype-parse');
var html2string = require('rehype-stringify');

tests = [
  '<script>alert(1)</script>',
  '&lt;script&gt;alert(1)&lt;script&gt;'
]

tests.forEach(s => unified()
  .use(html)
  .use(html2string, { entities: { useShortestReferences: true } } )
  .process(s, function (err, file) {
    console.log(String(file))
  })
);

I get:

<html><head><script>alert(1)</script></head><body></body></html>
<html><head></head><body>&#x3C;script>alert(1)&#x3C;script></body></html>

Why is &lt not being decoded while the rest are? I feel like maybe it's intentional to break script injection but, it's strange just applying to <. Is it possible to turn this off somehow?

Note if I remove { entities: { useShortestReferences: true } } < is transformed to <.

Answered by wooorm

Feb 13, 2021

The > does not need to be encoded 🤷‍♂️ If a browser or something else is parsing HTML, and it’s in text, then when it sees >, it’s just like when it sees any other character!

View full answer

wooorm · 2021-02-13T09:14:26Z

wooorm
Feb 13, 2021
Maintainer

The > does not need to be encoded 🤷‍♂️ If a browser or something else is parsing HTML, and it’s in text, then when it sees >, it’s just like when it sees any other character!

4 replies

sgpinkus Feb 13, 2021
Author

Thanks @wooorm.

I wasn't asking why ">" doesn't need to be encoded. I was asking more, why "<" does need to be encoded (or rather remain encoded while the rest are decoded), and, how I can make the parsing pipeline let me decide what does and what doesn't need to be encoded :).

wooorm Feb 13, 2021
Maintainer

because if you feed console.log("eval(1)") to a javascript parser, it’s logging a string, not evaluating markdown, either..

This sounds a lot like an xy problem: https://xyproblem.info

sgpinkus Feb 13, 2021
Author

X: "Why is < not being decoded while the rest are?". Background context "My objective is to make that not happen, how can I?" That's not XY. There is no Y's :).

sgpinkus Feb 14, 2021
Author

Ah I get it now. A better example:

var unified = require('unified')
var html = require('rehype-parse');
var html2string = require('rehype-stringify');

test = '&lt;script&gt;alert(0)&lt;script&gt;<i>alpha &#xA9; &amp; bravo &#x2260; &amp; charlie &#x1D306;</i>';
unified()
  .use(html)
  .use(html2string, {})
  .process(test, function (err, file) {
    console.log(String(file))
  })

gives:

<html><head></head><body>&#x3C;script>alert(0)&#x3C;script><i>alpha © &#x26; bravo ≠ &#x26; charlie 𝌆</i></body></html>

All the encoded entities are decoded by rehype-parse. Then when the string is dumped, rehype-stringify only re-encodes the characters that cause the string to be interpreted improperly as HTML, or rather differently to what was input. There is no remembering what was and wasn't decoded from the original ..

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

rehype

Why is "<" escape encoded by rehype-stringify and how to disable? #51

{{title}}

Replies: 1 comment 4 replies

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

Select a reply

rehype

Why is "<" escape encoded by rehype-stringify and how to disable? #51

sgpinkus Feb 12, 2021

Replies: 1 comment · 4 replies

wooorm Feb 13, 2021 Maintainer

sgpinkus Feb 13, 2021 Author

wooorm Feb 13, 2021 Maintainer

sgpinkus Feb 13, 2021 Author

sgpinkus Feb 14, 2021 Author

sgpinkus
Feb 12, 2021

Replies: 1 comment 4 replies

wooorm
Feb 13, 2021
Maintainer

sgpinkus Feb 13, 2021
Author

wooorm Feb 13, 2021
Maintainer

sgpinkus Feb 13, 2021
Author

sgpinkus Feb 14, 2021
Author