[wp-trac] [WordPress Trac] #38434: Un-escaped character in svg-painter.js results in JavaScript errors with some CDN services

[WordPress Trac]

#38434: Un-escaped character in svg-painter.js results in JavaScript errors with
some CDN services
--------------------------+-----------------------------------------
 Reporter:  georgemandis  |       Owner:  (none)
     Type:  defect (bug)  |      Status:  new
 Priority:  normal        |   Milestone:
Component:  General       |     Version:  4.6.1
 Severity:  normal        |  Resolution:
 Keywords:                |     Focuses:  javascript, administration
--------------------------+-----------------------------------------
Changes (by desrosj):

 * focuses:  javascript => javascript, administration
 * milestone:  Awaiting Review =>


Comment:

 Hey @georgemandis,

 Thanks for opening this!

 I have done a bunch of testing on my Bluehost test sites using the
 Incapsula CDN through Sitelock, and I have been unable to reproduce this.
 I also spoke with a member of the Sitelock team and they confirmed. If I
 had to guess, this was patched upstream pretty quickly by Incapsula.

 As to why only the password functionality was broken, my speculation is
 that all JavaScript prior to `svg-painter.js` loaded correctly, and
 everything after was affected by the error. `zxcvbn.js` and `zxcvbn-
 async.js` are two files that control the password fields.

 If you are still experiencing this issue, please open a support request
 with Bluehost or Sitelock. While the character causing the issue is in
 Core, this is more of a request to direct at the service that is
 incorrectly processing the files.

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/38434#comment:3>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform