xom-interest AT lists.ibiblio.org

Subject: XOM API for Processing XML with Java

List archive

Re: [XOM-interest] XOM-interest Digest, Vol 47, Issue 6

From: Ed Davies <edavies AT nildram.co.uk>
To: Jeff Williams <jeff.williams AT aspectsecurity.com>, xom-interest AT lists.ibiblio.org
Subject: Re: [XOM-interest] XOM-interest Digest, Vol 47, Issue 6
Date: Tue, 12 Dec 2006 12:00:06 +0000

Jeff Williams wrote:

...
CDATA can also be used to obfuscate certain kinds of attacks. E.g.

<![CDATA[<IMG SRC="javas]]><![CDATA[cript:alert('XSS');">]]>

It still seems reasonable to me to take a positive security model and
ban CDATA if you are not 100% sure that it is safe. I'm not convinced
yet.
...

Exactly which piece of software would be confused by the above
"obfuscation" but would successfully protect against:

<IMG SRC="javascript:alert('XSS');">

?

Ed.

Re: [XOM-interest] XOM-interest Digest, Vol 47, Issue 6, Jeff Williams, 12/11/2006
- Re: [XOM-interest] XOM-interest Digest, Vol 47, Issue 6, Steve Loughran, 12/12/2006
  - Re: [XOM-interest] XOM-interest Digest, Vol 47, Issue 6, Wolfgang Hoschek, 12/12/2006
- Re: [XOM-interest] XOM-interest Digest, Vol 47, Issue 6, Elliotte Harold, 12/12/2006
- Re: [XOM-interest] XOM-interest Digest, Vol 47, Issue 6, Elliotte Harold, 12/12/2006
- Re: [XOM-interest] XOM-interest Digest, Vol 47, Issue 6, Ed Davies, 12/12/2006
  - Re: [XOM-interest] XOM-interest Digest, Vol 47, Issue 6, Jeff Williams, 12/12/2006
    - Re: [XOM-interest] XOM-interest Digest, Vol 47, Issue 6, Elliotte Harold, 12/12/2006
    - Re: [XOM-interest] CDATA sections vs character entities in browsers, Ed Davies, 12/13/2006
      - Re: [XOM-interest] CDATA sections vs character entities in browsers, John Cowan, 12/13/2006
- Re: [XOM-interest] XOM-interest Digest, Vol 47, Issue 6, Elliotte Harold, 12/12/2006