Skip to Content.
Sympa Menu

xom-interest - Re: [XOM-interest] XOM-interest Digest, Vol 47, Issue 6

xom-interest AT lists.ibiblio.org

Subject: XOM API for Processing XML with Java

List archive

Chronological Thread  
  • From: Ed Davies <edavies AT nildram.co.uk>
  • To: Jeff Williams <jeff.williams AT aspectsecurity.com>, xom-interest AT lists.ibiblio.org
  • Subject: Re: [XOM-interest] XOM-interest Digest, Vol 47, Issue 6
  • Date: Tue, 12 Dec 2006 12:00:06 +0000

Jeff Williams wrote:
...
CDATA can also be used to obfuscate certain kinds of attacks. E.g.

<![CDATA[<IMG SRC="javas]]><![CDATA[cript:alert('XSS');">]]>

It still seems reasonable to me to take a positive security model and
ban CDATA if you are not 100% sure that it is safe. I'm not convinced
yet.
...

Exactly which piece of software would be confused by the above
"obfuscation" but would successfully protect against:

&lt;IMG SRC="javascript:alert('XSS');">

?

Ed.






Archive powered by MHonArc 2.6.24.

Top of Page