Whimsy: Put That Test Down! You don't know where it's been
summary
A failing CSS-sanitization test traces through git to a 2007 inSticky case and propagates 14 years across html5lib luffa and Rails, caused by mixed octal/hex escapes that are actually octal encoding vs CSS unicode confusion. The investigation uses git bisect, archive searches and exploit spreadsheets to reconstruct a heredity diagram and confirm a real XSS payload, then fixes tests in Rails and luffa and files a PR to OWASP, showing archaeology reveals real bugs.
AI-written summary · about
chapters (4)
- 0:00Start
- 4:17WHAT IF THIS TEST IS JUST ENCODED WRONG?
- 11:31SECURITY IS HARD Tt's not always obvious when a security test has an error, Because exploits are often complex and non-obvious.
- 11:53ALWAYS TAKE THE RED PILL Archaeology and debugging are more work, But it could end up being fun, And you might get a conference talk out of it.
