Skip to Content.
Sympa Menu

xom-interest - Re: [XOM-interest] XOM-interest Digest, Vol 47, Issue 6

xom-interest AT lists.ibiblio.org

Subject: XOM API for Processing XML with Java

List archive

Chronological Thread  
  • From: "Jeff Williams" <jeff.williams AT aspectsecurity.com>
  • To: "Ed Davies" <edavies AT nildram.co.uk>, <xom-interest AT lists.ibiblio.org>
  • Subject: Re: [XOM-interest] XOM-interest Digest, Vol 47, Issue 6
  • Date: Tue, 12 Dec 2006 09:28:44 -0500

> Exactly which piece of software would be confused by the above
> "obfuscation" but would successfully protect against:
>
> &lt;IMG SRC="javascript:alert('XSS');">

Any browser.

--Jeff

-----Original Message-----
From: Ed Davies [mailto:edavies AT nildram.co.uk]
Sent: Tuesday, December 12, 2006 7:00 AM
To: Jeff Williams; xom-interest AT lists.ibiblio.org
Subject: Re: [XOM-interest] XOM-interest Digest, Vol 47, Issue 6

Jeff Williams wrote:
> ...
> CDATA can also be used to obfuscate certain kinds of attacks. E.g.
>
> <![CDATA[<IMG SRC="javas]]><![CDATA[cript:alert('XSS');">]]>
>
> It still seems reasonable to me to take a positive security model and
> ban CDATA if you are not 100% sure that it is safe. I'm not convinced
> yet.
> ...


?

Ed.






Archive powered by MHonArc 2.6.24.

Top of Page