Ok, it’s time to get out your baseball bats and try to break open this piñata. This is a little testing ground to see if you can generate a YSOD by breaking the XHTML well-formedness of my hacked WordPress install.
Leave a comment to try and break the site. I’ll periodically remove comments here, so try as often as you want with as many dirty tricks as you can (nothing malicious please, just demonstrative). I have a feeling this is opening a can of, well, you know…
The scores so far:
- Sam: 2 (duplicate attributes, two dashes in a XML comment)
- Haruka: 1 (open tags are not closed when Wordpress inserts a closing </p> tag)
- Jacques: 1 (invalid Unicode characters)
- Jeff: 1 (Raw text  not escaped)
Comment: <!– foo -- bar –>
2008-04-08 @ 5:29 AM
Sam, that should now work, see WP trac above.
2008-04-08 @ 1:30 PM
Here is my test, just being goofy here…
>$%^#%!@#$@$&*&%(%&!#$>a///\\\\\/////\\\\\
2008-04-09 @ 6:10 AM
< nbsp; & & //
<script >
document.writeln(’hello world!<br/<\n’);
</script >
Human testing the test page! blah
2008-04-23 @ 10:36 PM
document.writeln(’hello world!\n’);
2008-04-23 @ 10:37 PM
fubar
2008-04-24 @ 1:15 AM
bar
2008-04-24 @ 1:17 AM
<a 7a=”foo”>bar</a>
and
<7a>foo</7a>
both are prevented from breaking the page, unless you are logged in, that is. (In case this is what Jacques tried here: http://blog.codedread.com/xhtml-pinata/#comment-12531
2008-04-28 @ 12:46 PM
How about this: <a invalid;name=”foo”>bar</a>
bar
2008-04-28 @ 12:48 PM
How about this: <a invalid#name=”foo”>bar</a>
bar
2008-04-28 @ 12:49 PM
Another invalid comment: <!– test —>
2008-04-28 @ 1:01 PM
<? foo ?>
2008-04-28 @ 1:02 PM
<a href=”foo”>Open link…
Open link…
2008-04-28 @ 1:03 PM
document.writeln(’hello world!<br/<\n’);
document.writeln(’hello world!<br/<\n’);
<a><strong>
<p>paragraph
<!—<<–>
Waves
2008-05-02 @ 3:28 AM
Nice one, Haruka! I’ll do some investigation on this - I’m pretty sure it’s an open WP bug (they should be closing your <a> and <strong> tags before inserting the closing </p> tag).
2008-05-02 @ 8:36 AM
Well, not going to break anything this time
About this comment escaping and all… wouldn’t it be easier to validate comments against some simple schema (say RelaxNG) and if something is wrong just use htmlspecialchars() or similar on the whole string? That’s all or nothing though… (preview helps with this).
2008-05-02 @ 12:12 PM
<a href=”