Comments on: New XSS vector

By: ÐœÐ¸Ð»Ð°Ð½

ÐœÐ¸Ð»Ð°Ð½ — Mon, 10 Nov 2008 11:53:17 +0000

Also works in IE8. thx

By: naughty.spanky.boy

naughty.spanky.boy — Fri, 29 Aug 2008 07:51:04 +0000

Hi,

I have an idea, for protecting websites against XSS attacks. Why not ban all the tags, and allow only predefined ones with ‘special’ care. Like, allow img only with src that starts with a http://, or allow a href but only if http https is found.

By: Gareth Heyes

Gareth Heyes — Thu, 28 Aug 2008 10:48:00 +0000

@jim

Hey jim thanks, why don’t you put a online demo of ESAPI like Mario’s smoketest? Then we’ll see how good it is

By: Jim Manico

Jim Manico — Wed, 27 Aug 2008 22:56:01 +0000

If only everyone had the power of

ESAPI.encoder().encodeForHTMLAttribute(String userData);

Great find, good job!

By: superhei

superhei — Wed, 27 Aug 2008 05:17:04 +0000

hi Gareth Heyes

good job
it work in ie6/7/8

By: Gareth Heyes

Gareth Heyes — Tue, 26 Aug 2008 21:54:27 +0000

Emailed rsnake but they won’t be added to the cheat sheet because there is no new event handler and javascript: is already mentioned

By: Gareth Heyes

Gareth Heyes — Tue, 26 Aug 2008 21:25:46 +0000

Also works in IE8

I’ll email him

By: x-tense

x-tense — Tue, 26 Aug 2008 21:16:31 +0000

You can remove the value of src attribute:

(only tested on IE6)

Did you ask to rsnake to add this vector ?