New answers tagged

0

Another problem not mentioned yet: you mentioned the JavaScript is served over plain HTTP. This means that a "man in the middle" (MITM) attack can modify the JavaScript enroute, removing the encryption, or even doing more nefarious things. You CAN do encryption client-side (there are some cases this makes sense) but it CANNOT replace HTTPS, only supplement ...


2

There is no huge security weaknesses with them. Actually, a lot of websites (banks notably) are already using web rendered keypads as part of their customer's website authentication mechanism. While there is still pros and cons, this offers the developers more flexibility than using standard OS input. In particular, the numbers can be presented in random ...


2

I think the scenario you are talking should be called HTML injection. Sometimes, there might be an XSS filter deployed which does not allow any event attribute (the list is huge) as well as script tags. In that case, "getting XSS is hard". Although, blacklists seldom work to prevent XSS.


2

No, I would not call that cross site scripting, since there is no actual scripting involved. But that does not mean it is not a security risk! The correct term for the vulnerability would be "HTML injection", and as you note in your question it can be a dangerous thing. Here's another example, just to show how HTML injection can indeed be used to cause real ...


0

If untrusted data can be everything, we could inject for example --><script>alert("I just escaped the HTML comment")</script><!-- which would make it appear in source code like: <!----><script>alert("I just escaped the HTML comment")</script><!---->(Note the empty comments)


5

The relevant entries in the HTML5 Security Cheatsheet are: Ending HTML comments with a backtick character: html5sec#133 (IE6, IE8) Injecting XSS or with a conditional comment html5sec#115 (older IE, IE quirks mode) Apart from that user input might be used to change this comment into a conditional comment (IE only) and thus change the DOM or block the ...


5

Are there any frameworks that work this way? Sure. Twig or Django would be two examples. The inverse of this is clearly a far more secure default, ie. all dynamic data is escaped, unless you specifically tell the framework not to. Yes, this is a lot more secure. Is there something I'm missing? The one downside is that XSS is context-sensitive....



Top 50 recent answers are included