Subject: Re: http-gw: A new patch for JavaScript quoting

From: "Larry Jackson" <[email-masked]>
Date: Fri, 5 May 2000 14:34:17 -0400

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

Should everyone automatically install the patch?

How do you know if I need this patch?

What symptoms were you seeing?

Thanks,
[email-masked]

From: Marcin CIE¦LAK <[email-masked]>
To: <[email-masked]>
>
> I have developed a bit better solution for
> JavaScript quoting in http-gw.
> Apparently, the http-gw seemed to remove
> the final quote in situations like:
>
> <a href=Missing_first quote">
> <a href=\"Some_guys__put_a_whole_code_in_js_variable\">
>
> The patch postpones a write of the
> final quote, _not_ removing the final quote from
> the attribute's value.
>
>               << Marcin Cie¶lak // [email-masked] >>

---

From: Marcin CIEŚLAK <[email-masked]>
Date: Sat, 6 May 2000 15:17:55 +0200 (MET DST)

On Fri, 5 May 2000, Larry Jackson wrote:

 -> How do you know if I need this patch?

I had a problem with http://www.intel.com/ ISPnet site (unfortunately,
one has to be registered there) - it had lots of stuff put into
a JavaScript variable like,
A
var blah = " ....
      <A HREF=\"link\">

All quotes there were quoted :) and http-gw change it to:

     <A HREF=\"link\> 

causing obvious errors. 

My patch fixes the reason, - http-gw used to add " at the end of quoted
strings, and it used strange mechanism to avoid it when it was
unnecessary, which resulted in chopping off the final quote.  

I assume my patch is safe for general deployment, so you may apply it
anyway, since today's JavaScript mangling techniques are getting
more and more complicated.

-- 
              << Marcin Cieślak // [email-masked] >>