RE: Preventing cross site scripting

You can never know all the 'unacceptible' tags and the escape versions etc.. Why not simple define the list of 'acceptible' tags, look for those, and anything you don't like you whitespace. Simple and safe! The worst your gonna get is an annoyed customer that thinks you screwed them on what they consider is valid. Better that than a bunch of REALLY annoyed customers who think your stuff is unsafe!

Cheers, Michael
Writing Secure Code 2nd Edition
http://www.microsoft.com/mspress/books/5957.asp

-----Original Message-----
From: David Cameron [mailto:dcameron@itis-now.com] Sent: Thursday, June 19, 2003 6:51 PM
To: Andrew Beverley; webappsec@securityfocus.com Subject: RE: Preventing cross site scripting

Create a list of unacceptable tags in an array (eg applet, embed), loop through the array and generate a regexpr based on the array, something of the form:
<(applet)|(embed).?> and replace all instances with "".

Do the same for any possible closing tags ie: </(applet)|(embed)> and replace all instances with "".

BTW the RegExpr may be wrong, I'm not all that hot on RegExprs, but you get the idea.

regards
David Cameron
nOw.b2b
dcameron@itis-now.com

> -----Original Message-----

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek

> the browser.

> understand the best way is to only allow acceptable information, in

> as input and strip out all nasty stuff? Does anyone have suggestions
Received on Fri Jun 20 08:32:58 2003