RegEx to find CFML tags nested in HTML tags

Discussion in 'Perl' started by Dean H. Saxe, Jan 3, 2004.

  1. Dean H. Saxe

    Dean H. Saxe Guest

    I'm currently developing a tool in perl to search out potential XSS
    (Cross Site Scripting) vulnerabilities and correct them in a
    ColdFusion based web app. I've been having great success so far,
    however, one scenario has me banging my head against the wall.

    I need a regex to find all <cfoutput ...>...</cfoutput> blocks in a
    CFM template. The regex should find all such blocks that are *not*
    nested within HTML tags (the tag itself, <cfoutput> blocks located
    between an opening and closing tag are OK). In other words a tag that
    looks like the following:

    <link rel="<cfoutput>#directory#/foo.css</cfoutput>">

    should be ignored by the regex.

    I have tried this a number of ways, however, I have not ocme up with a
    solution yet.

    The basic RegEx to match the <cfoutput> block is:

    $text =~ s/(<cfoutput[^>]*>.*?<\/cfoutput>)/process_cfoutput($1)/sige;

    This of course doesn't provide the tag exclusion that I am looking
    for.

    The next RegEx finds the <cfoutput> block in the tag and continues
    matching through the first <cfoutput> block it finds not nested in a
    tag, returning too much data.

    $text =~ s/(<cfoutput[^>]*>.*?<\/cfoutput>)(?=[^>]*(<|$))/process_cfoutput($1)/sige;

    From this point forward I tried various lookaround constructs to limit
    the scope of the match without any luck. Any help that can be offered
    is greatly appreciated.


    Thanks,
    -dhs
    Dean H. Saxe, Jan 3, 2004
    #1
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Daniel M. Hendricks

    Regex to strip evil HTML tags

    Daniel M. Hendricks, Apr 10, 2005, in forum: ASP .Net
    Replies:
    2
    Views:
    6,021
    vMike
    Apr 11, 2005
  2. =?Utf-8?B?SmViQnVzaGVsbA==?=

    Is ASP Validator Regex Engine Same As VS2003 Find Regex Engine?

    =?Utf-8?B?SmViQnVzaGVsbA==?=, Oct 22, 2005, in forum: ASP .Net
    Replies:
    2
    Views:
    696
    =?Utf-8?B?SmViQnVzaGVsbA==?=
    Oct 22, 2005
  3. Spondishy
    Replies:
    3
    Views:
    839
    Spondishy
    Jan 4, 2006
  4. Hero41Day
    Replies:
    3
    Views:
    992
    =?ISO-8859-1?Q?G=F6ran_Andersson?=
    Jun 3, 2006
  5. Replies:
    3
    Views:
    748
    Reedick, Andrew
    Jul 1, 2008
Loading...

Share This Page