Bug 763 : domita_test.js canonInnerHtml may be subverted

From http://code.google.com/p/google-caja/issues/detail?id=763 :

   (Originally found by Mike Stay.) The regex in domita_test.js
   canonInnerHtml that says:

      new RegExp('(<\\w+)\\s+([^\\s>][^>]*)>', 'g'),

    does not match the case where there are angle brackets *inside* an
    attribute, as in:

      <div id=">">

    It seems that some browsers may get weird with escaping angle
    brackets (though Firefox 3 does the safe thing); see:

      http://groups.google.com/group/opera.beta/msg/32380d8ca64c3096

    In any case, maybe worth a look to make sure we don't get
    spuriously failing or (worse) succeeding tests when regressing on
    multiple browsers.


Submitted @3761

[metaweta, 2009-09-26 17:17:55]

On 2009/09/26 02:56:42, MikeSamuel wrote:
> 

lgtm