Re: Preventing cross site scripting

• Original Message ----- From: "Laurian Gridinoc" <laur@grapefruitdesign.com> To: "Wojciech Purczynski" <cliph@isec.pl> Cc: "Tim Greer" <chatmaster@charter.net>; <webappsec@securityfocus.com> Sent: Friday, June 20, 2003 9:21 AM Subject: Re: Preventing cross site scripting

> The most elegant way to control html input would be to parse it to a DOM

Can you give a real workd example of a URL link/anchor tag on how you would allow or disallow it from becoming active based on specific variables that would prevent an attack that would be a superior method over a regex example, such as I offered?

>
> I consider filtering html as it was a mere string (i.e. using regexp or

I don't see how anything would be better than a regex, but everyone has their preferences. TIMTOWTDI, I'm sure. You think regex's aren't quite programming? :()

--
Regards,
Tim Greer  chatmaster@charter.net
Server administration, security, programming, consulting.