Feature request: Implement JavaScript unescape function
- Dominant language
- JavaScript
- Stars
- 35.8k
- Forks
- 4.1k
- Avg merge
- 2d 26m
- Merged PRs (30d)
- 33
Description
**Is your feature request related to a problem? Please describe.**
While analyzing recent html smuggling attacks, I found a file that uses the `unescape` JavaScript function like so:
`document.write( unescape( '%3Chtml%20dir%3D%22ltr%22%20lang%3D%22en [...]`
Usually I use `URL Decode` for this task. But in the given file there were calculations that use the `+` (plus) sign. The plus sign is replaced by the URL Decode with a space character. Hence I am asking for a new Operation for the JS unescape function.
Obfuscated code:
```js
parseInt%28K%280x5d7%2C0x6b9%2C0x457%2C0x531%2C0x54a%29%29/%280x19c7+0x1c38+-0x35fe%29
```
URL Decode will decode to this result, which leads to syntax errors:
```js
parseInt(K(0x5d7,0x6b9,0x457,0x531,0x54a))/(0x19c7 0x1c38 -0x35fe)
```
Expected result:
```js
parseInt(K(0x5d7,0x6b9,0x457,0x531,0x54a))/(0x19c7+0x1c38+-0x35fe)
```
**Describe the solution you'd like**
Implement the JS unescape function as a new Operation in order to make HTML smuggling analysis easier.
**Describe alternatives you've considered**
Alternatively add a switch for the `URL Decode` Operation to leave e.g. the plus sign (maybe even other chars?) as they are and not replace them with a space.
Apart from that, two workarounds would be:
1) just run the `unescape( '%3Chtml%20dir%3D%22ltr%22%20lang%3D%22en [...]` directly in a browser's console and copy/paste the result to your editor again to analyze the unescaped code
2) `Find/Replace` the plus signs with some unique char sequence (such as `@@@`) then do `URL Decode`, then again `Find/Replace` the unique char sequence with a plus sign again
These do the job, but they don't prevent me from running into issues in the first place, because at first I did not notice the syntax errors in the decoded result.
**Additional context**
N/A
Contributor guide
Assessment
This issue has not been assessed yet.