Re: [WEB SECURITY] Is ^ a dangerous metachar?

["Brian Eaton" <eaton.lists@xxxxxxxxx>]

On 1/8/07, Haroon Meer <haroon@xxxxxxxxxxxxx> wrote:
> PS.. it bears repeating that you cant know every meta-character that
> could hurt you / your application and you would be better advised to
> whitelist (this field accepts mixed-case alphanumeric) instead of trying
> to blacklist (this filed wont accept ;'<>).

I agree with this in theory, but I find I can't often apply this
policy in practice.  The applications I work on are usually expected
to deal with non-english data supplied as unicode.  I would need to
use a white list of 65,000 characters.

Instead I try to use APIs that distinguish between code and data, e.g.
working with HTML using the DOM tree instead of using strings.  (Of
course, then you have the fun of worrying about DOM-based XSS...)

Regards,
Brian

----------------------------------------------------------------------------
The Web Security Mailing List: 
http://www.webappsec.org/lists/websecurity/

The Web Security Mailing List Archives: 
http://www.webappsec.org/lists/websecurity/archive/
http://www.webappsec.org/rss/websecurity.rss [RSS Feed]