diff --git a/lib/markdown2.py b/lib/markdown2.py index 929d29c4..16672f51 100755 --- a/lib/markdown2.py +++ b/lib/markdown2.py @@ -2134,7 +2134,7 @@ def _encode_amps_and_angles(self, text): text = self._naked_gt_re.sub('>', text) return text - _incomplete_tags_re = re.compile("<(/?\w+\s+)") + _incomplete_tags_re = re.compile("<(/?\w+[\s/]+?)") def _encode_incomplete_tags(self, text): if self.safe_mode not in ("replace", "escape"): diff --git a/test/tm-cases/CVE-2018-5773.html b/test/tm-cases/CVE-2018-5773.html index 86b6da18..6d9e6e53 100644 --- a/test/tm-cases/CVE-2018-5773.html +++ b/test/tm-cases/CVE-2018-5773.html @@ -1,3 +1,7 @@

<img src="" onerror=alert(/XSS/)

</img src="" onerror=alert(/XSS/)

+ +

<img/src="" onerror=alert(/XSS/)

+ +

</img/src="" onerror=alert(/XSS/)

diff --git a/test/tm-cases/CVE-2018-5773.text b/test/tm-cases/CVE-2018-5773.text index d8bfcbfe..c82970e9 100644 --- a/test/tm-cases/CVE-2018-5773.text +++ b/test/tm-cases/CVE-2018-5773.text @@ -1,3 +1,7 @@