I might be asking a similar question to this: Whitelisting DOM elements to defeat XSS But I think my proposed solution is different and I was wondering if I could get the community to comment on ...
Is a browser like Firefox with disabled scripts (for example via a plugin like no-script) and disabled java enough to be protected against dryve-by-malware from the internet. Of course this does not ...
Is DWR considered secure, or what may be required to secure Direct Web Remoting? Are there better options for hardened asynchronous communication?
I have been developing a Webobjects application, and I found that my application is vulnerable to XSS through URL, but not when malicious input like <script>alert("hi")</script> is input ...