Re: [WEB SECURITY] Nice little XSS trick

[Bil Corry <bil@xxxxxxxxx>]

White, Dain P wrote on 7/15/2008 3:34 PM: 
> Normally (for me) this involves a whitelist of accepted tags, and a 
> blacklist that scours the content for Bad Things, via regex. In my 
> particular case, this XSS wouldn't work, because the vector isn't in 
> my whitelist and would be removed - but not everyone uses this sort 
> of hybrid "greylist" approach - they rely on a blacklist that is 
> looking for "script" - and in that case, this sort of attack is 
> certainly a Bad Thing.

You might be interested in this:

	<http://htmlpurifier.org/>

And this is a pretty good read on the topic:

	<http://www.gnucitizen.org/blog/bulletproof-rich-content-filters>

Personally, I avoid allowing users to submit HTML.


- Bil


----------------------------------------------------------------------------
Join us on IRC: irc.freenode.net #webappsec

Have a question? Search The Web Security Mailing List Archives: 
http://www.webappsec.org/lists/websecurity/archive/

Subscribe via RSS: 
http://www.webappsec.org/rss/websecurity.rss [RSS Feed]

Join WASC on LinkedIn
http://www.linkedin.com/e/gis/83336/4B20E4374DBA