Skip to Content.
Sympa Menu

xom-interest - Re: [XOM-interest] CDATA sections vs character entities in browsers

xom-interest AT lists.ibiblio.org

Subject: XOM API for Processing XML with Java

List archive

Chronological Thread  
  • From: Ed Davies <edavies AT nildram.co.uk>
  • To: xom-interest AT lists.ibiblio.org
  • Subject: Re: [XOM-interest] CDATA sections vs character entities in browsers
  • Date: Wed, 13 Dec 2006 11:17:34 +0000

I asked:
Exactly which piece of software would be confused by the above
"obfuscation" but would successfully protect against:

&lt;IMG SRC="javascript:alert('XSS');">

Jeff Williams replied:
Any browser.

Firefox is the second most "any" browser. Trying the CDATA
and character entity examples in both HTML (quirks and
standard compliance modes) and XHTML showed a few surprising
(to me) differences in processing: in HTML the CDATA sections
were taken as comments which surprised me a lot as I thought
that CDATA sections were part of HTML and in XHTML the
"CDATAness" of the text was preserved in the DOM which
surprised me a tiny bit - I should have known better as I was
vaguely aware that the DOM includes CDATA interfaces but maybe
I'm too indoctrinated by XSLT and had blocked that unpleasant-
ness out of my mind.

However, in none of the cases was there any suggestion at
all that the tag would be interpreted as an image element
and certainly no chance of the javascript being executed -
not even when I added the final "/" in the XHTML version
which would be required to turn the start tag into an empty
element tag.

In what circumstances would it make a security difference
to a browser which form is used?

Ed.






Archive powered by MHonArc 2.6.24.

Top of Page