OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: Ulf Harnhammar (ulfh_at_update.uu.se)
Date: Sat Nov 09 2002 - 21:21:41 CST

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    On Thu, 7 Nov 2002, Justin King wrote:

    > I would be very interested in major browsers supporting a <dead> tag with an
    > optional parameter to be a hash of the data between the opening and closing
    > dead tag. This tag would indicate that no "live" elements of HTML be
    > supported (e.g., JavaScript, VBScript, embed, object).

    I'm not sure if that's the best solution. Lots of code out there do much
    less filtering than it should, so there will probably be a way to include
    a </dead> tag and then use all the usual XSS tricks.

    // Ulf Harnhammar
       VSU Security
       ulfhupdate.uu.se