XOM API for Processing XML with Java

["Jeff Williams" <jeff.williams AT aspectsecurity.com>]

> Exactly which piece of software would be confused by the above
> "obfuscation" but would successfully protect against:
>
>   <IMG SRC="javascript:alert('XSS');">

Any browser.

--Jeff

-----Original Message-----
From: Ed Davies [mailto:edavies AT nildram.co.uk] 
Sent: Tuesday, December 12, 2006 7:00 AM
To: Jeff Williams; xom-interest AT lists.ibiblio.org
Subject: Re: [XOM-interest] XOM-interest Digest, Vol 47, Issue 6

Jeff Williams wrote:
> ...
> CDATA can also be used to obfuscate certain kinds of attacks. E.g.
> 
>      <![CDATA[<IMG SRC="javas]]><![CDATA[cript:alert('XSS');">]]>
> 
> It still seems reasonable to me to take a positive security model and
> ban CDATA if you are not 100% sure that it is safe.  I'm not convinced
> yet.
> ...


?

Ed.