2

Is it likely or possible for img tag, or any other to be parsed, when the < tag is several characters prior, or perhaps omitted? Would this happen in any notable HTML parsers?

For example <div>$test</div>.

Where $test could be any string containing a >, but not a <. Such as img>, but not <img

Full disclosure: This question is specifically to see whether or not the comment I posted was correct.

Community
  • 1
  • 1
700 Software
  • 85,281
  • 83
  • 234
  • 341
  • I edited the question to try and make it less "primarily opinion-based" I welcome additional suggestions or edits. – 700 Software Jul 16 '13 at 19:53
  • +1 just because I'm curious, and as the question, *at the time I made this comment*, isn't primarily opinion based. In short, I cannot think of a reason any browsers would parse `img` without being immediately preceded by `<` as an image DOM node, but I only have my own self assuredness to back that up, which isn't enough. – JayC Jul 16 '13 at 20:22
  • In other words, I think the question is relevant for the same reason you do, it seems. – JayC Jul 16 '13 at 20:24

3 Answers3

1

Well, out of curiosity, I changed one of my test pages so its script section began with this:

< script>

The result was completely broken and just printed all of my javascript. This happened in IE9, GC28, and Firefox. I didn't really have an image on-hand to test with, but I think we can derive from this that HTML tags are always required to have no white-space between the angle bracket and tag declaration.

If you'd like even further confirmation, I suggest you browse the W3C standardization documents to see if you can find where they declare the generic pattern for HTML element tags. Many HTML parsers probably base themselves off those documents to ease their coding.

Katana314
  • 8,429
  • 2
  • 28
  • 36
1

You don't technically need either < or >. Load this up in IE, and it'll run a javascript alert. Not sure if it's possible without messing with the charset though.

<HTML>
<HEAD>
<META charset="UTF-7">
</HEAD>
<BODY>
<DIV>+ADw-script+AD4-alert(+ACI-XSS+ACI-)+ADw-/script+AD4-</DIV>
</BODY>
</HTML>

Source: http://securityoverride.org/articles.php?article_id=13

Adam
  • 882
  • 5
  • 10
0

White space is allowed after the tagname

< script> is invalid while <script> is valid

Alexei - check Codidact
  • 22,016
  • 16
  • 145
  • 164
pwynne
  • 13
  • 4