From: Alex Lambert (alambertquickfire.org)
Date: Thu Jun 19 2003 - 21:13:38 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

What about onClick (etc) attributes? i.e. <img src="good.gif*"
onMouseOver="evil();">

JavaScript entities are rare but dangerous. See Gobbles's unoriginal
advisory at
http://cert.uni-stuttgart.de/archive/bugtraq/2002/05/msg00096.html

Whitelisting is preferable to blacklisting. Allow through only what is
needed.

There was a similar question posted last year;
http://www.securityfocus.com/archive/107/269374/2003-06-17/2003-06-23/1

Hope this helps! :)

Alex Lambert

* expires tomorrow, whee! http://burnallgifs.org/

----- Original Message -----
From: "David Cameron" <dcameronitis-now.com>
To: "Andrew Beverley" <mailandybev.com>; <webappsecsecurityfocus.com>
Sent: Thursday, June 19, 2003 8:50 PM
Subject: RE: Preventing cross site scripting

Create a list of unacceptable tags in an array (eg applet, embed), loop
through the array and generate a regexpr based on the array, something of
the form:
<(applet)|(embed).?> and replace all instances with "".

Do the same for any possible closing tags ie:
</(applet)|(embed)> and replace all instances with "".

BTW the RegExpr may be wrong, I'm not all that hot on RegExprs, but you get
the idea.

regards
David Cameron
nOw.b2b
dcameronitis-now.com

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]