XOM API for Processing XML with Java

[Ed Davies <edavies AT nildram.co.uk>]

I asked:
> > Exactly which piece of software would be confused by the above
> > "obfuscation" but would successfully protect against:
> >
> >   <IMG SRC="javascript:alert('XSS');">

Jeff Williams replied:
> Any browser.

Firefox is the second most "any" browser.  Trying the CDATA
and character entity examples in both HTML (quirks and
standard compliance modes) and XHTML showed a few surprising
(to me) differences in processing: in HTML the CDATA sections
were taken as comments which surprised me a lot as I thought
that CDATA sections were part of HTML and in XHTML the
"CDATAness" of the text was preserved in the DOM which
surprised me a tiny bit - I should have known better as I was
vaguely aware that the DOM includes CDATA interfaces but maybe
I'm too indoctrinated by XSLT and had blocked that unpleasant-
ness out of my mind.

However, in none of the cases was there any suggestion at
all that the tag would be interpreted as an image element
and certainly no chance of the javascript being executed -
not even when I added the final "/" in the XHTML version
which would be required to turn the start tag into an empty
element tag.

In what circumstances would it make a security difference
to a browser which form is used?

Ed.