Summary
When building an HTML options list the value is not escaped. This causes some of the value to be displayed in the name.
Example
This is a problem for RegExs because some contain a " followed by a > which causes part of the regex to appear in the name because the HTML is parsed incorrectly, as shown below.
Link to show bug
This issue comes from Line 159 and is present in other places, where the HTML value is not escaped, but the values don't trigger it
|
html += `<option populate-value="${this.value[i].value}">${this.value[i].name}</option>`; |
Summary
When building an HTML options list the value is not escaped. This causes some of the value to be displayed in the name.
Example
This is a problem for RegExs because some contain a
"followed by a>which causes part of the regex to appear in the name because the HTML is parsed incorrectly, as shown below.Link to show bug
This issue comes from Line 159 and is present in other places, where the HTML value is not escaped, but the values don't trigger it
CyberChef/src/web/HTMLIngredient.mjs
Line 159 in 6f8a5ea