Issue 4684 - Allow { and } in attribute and property selectors

lib/filterClasses.js

 /*
  * This file is part of Adblock Plus <https://adblockplus.org/>,
  * Copyright (C) 2006-2016 Eyeo GmbH
  *
  * Adblock Plus is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
  * published by the Free Software Foundation.
  *
  * Adblock Plus is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ skipping 67 matching lines @@
 /**
  * Cache for known filters, maps string representation to filter objects.
  * @type Object
  */
 Filter.knownFilters = Object.create(null);
 
 /**
  * Regular expression that element hiding filters should match
  * @type RegExp
  */
-Filter.elemhideRegExp = /^([^\/\*\|\@"!]*?)#(\@)?(?:([\w\-]+|\*)((?:\([\w\-]+(?:[$^*]?=[^\(\)"]*)?\))*)|#([^{}]+))$/;
+Filter.elemhideRegExp = /^([^\/\*\|\@"!]*?)#(\@)?(?:([\w\-]+|\*)((?:\([\w\-]+(?:[$^*]?=[^\(\)"]*)?\))*)|#(.+))$/;
 /**
  * Regular expression that RegExp filters specified as RegExps should match
  * @type RegExp
  */
 Filter.regexpRegExp = /^(@@)?\/.*\/(?:\$~?[\w\-]+(?:=[^,\s]+)?(?:,~?[\w\-]+(?:=[^,\s]+)?)*)?$/;
 /**
  * Regular expression that options on a RegExp filter should match
  * @type RegExp
  */
 Filter.optionsRegExp = /\$(~?[\w\-]+(?:=[^,\s]+)?(?:,~?[\w\-]+(?:=[^,\s]+)?)*)$/;
@@ skipping 720 matching lines @@
  * @param {String} selector   CSS selector for the HTML elements that should be hidden
  * @constructor
  * @augments ActiveFilter
  */
 function ElemHideBase(text, domains, selector)
 {
   ActiveFilter.call(this, text, domains || null);
 
   if (domains)
     this.selectorDomain = domains.replace(/,~[^,]+/g, "").replace(/^~[^,]+,?/, "").toLowerCase();
-  this.selector = selector;
+
+  // Braces are being escaped to prevent CSS rule injection.
+  this.selector = selector.replace("{", "\\x7B").replace("}", "\\x7D");

[Wladimir Palant, 2016/12/13 14:32:16]

I was probably not clear enough but the space at the end is important: the
replacement string should be "\x7B " (yes, in CSS that space is really part of
the escape sequence). As you have it right now the selector foo="{1234" will be
converted into foo="\x7B1234" which will expect a single Unicode character
inside the attribute.

[Felix Dahlke, 2016/12/13 16:04:48]

Done. I gotta admit this is feeling hacky. But I think I've fixed it as
suggested now.

[Wladimir Palant, 2016/12/13 16:29:12]

This is exactly how EHH is doing it - took a while to arrive at a reliable
solution.

 }
 exports.ElemHideBase = ElemHideBase;
 
 ElemHideBase.prototype = extend(ActiveFilter, {
   /**
    * @see ActiveFilter.domainSeparator
    */
   domainSeparator: ",",
 
   /**
@@ skipping 131 matching lines @@
  */
 function ElemHideEmulationFilter(text, domains, selector)
 {
   ElemHideBase.call(this, text, domains, selector);
 }
 exports.ElemHideEmulationFilter = ElemHideEmulationFilter;
 
 ElemHideEmulationFilter.prototype = extend(ElemHideBase, {
   type: "elemhideemulation"
 });