Files with <script> in their name break the plugin

[ojii]

adding a file named <script>alert('test') breaks multifile with Uncaught SyntaxError: Invalid regular expression flags. A file named <script>alert('test')<:script> fails with Uncaught SyntaxError: Unexpected token :.

[fyneworks]

Can you share a sample of your code?

Do you mean the input element has that in its name attribute?

Or do you mean you selected a file that has that name?

Either way, it seems to be a very strange (if at all valid) name value.

[ojii]

I used the demo on your page. The file has that name. We detected this issue during XSS testing of our site.

[fyneworks]

Not sure how to help with this to be honest. I can't reproduce the problem. Can you at least trace the error (or provide a line number)?

[ojii]

Here's the smallest example I could come up with:

example.zip

To run (needs Python 3.5 and Firefox):

• python3.5 -m venv env
• env/bin/pip install selenium
• env/bin/python test.py

Alternatively, look at the code and check this output it generates for me:

{'message': "expected expression, got ':'",
 'stackTrace': [{'columnNumber': 2609,
                 'fileName': 'http://localhost:62189/jquery.min.js',
                 'lineNumber': 2,
                 'methodName': '.globalEval/<'},
                {'columnNumber': 2583,
                 'fileName': 'http://localhost:62189/jquery.min.js',
                 'lineNumber': 2,
                 'methodName': '.globalEval'},
                {'columnNumber': 22513,
                 'fileName': 'http://localhost:62189/jquery.min.js',
                 'lineNumber': 3,
                 'methodName': '.domManip'},
                {'columnNumber': 20023,
                 'fileName': 'http://localhost:62189/jquery.min.js',
                 'lineNumber': 3,
                 'methodName': '.append'},
                {'columnNumber': 7023,
                 'fileName': 'http://localhost:62189/jquery.MultiFile.min.js',
                 'lineNumber': 1,
                 'methodName': 'a.fn.MultiFile/</f.addToList'},
                {'columnNumber': 5078,
                 'fileName': 'http://localhost:62189/jquery.MultiFile.min.js',
                 'lineNumber': 1,
                 'methodName': 'a.fn.MultiFile/</f.addSlave/<'},
                {'columnNumber': 8014,
                 'fileName': 'http://localhost:62189/jquery.min.js',
                 'lineNumber': 3,
                 'methodName': 'n.event.dispatch'},
                {'columnNumber': 4750,
                 'fileName': 'http://localhost:62189/jquery.min.js',
                 'lineNumber': 3,
                 'methodName': 'n.event.add/r.handle'}]}