139 reputation
8
bio website
location Aachen, Germany
age 18
visits member for 2 years, 3 months
seen Feb 11 at 21:34

‚Äč


Mar
26
awarded  Popular Question
Jun
4
comment Could my bank's two-factor authentication be hacked?
Yes they can 'cause of gsm. ftp.ccc.de/congress/2012/mp4-h264-HQ/… Start at minute 30.
May
14
awarded  Critic
Aug
28
comment Is it safer to use less heard of software than popular software?
Use open source software!
Aug
15
comment Is it secure to use jQuery on the server-side for user input validation?
As you can see in my code I whitelist already however the "unexpected" behaviour is not unexpected to me. BTW it can't happen because I don't output server-side vars inside the script tag.
Aug
12
comment Is it secure to use jQuery on the server-side for user input validation?
@D.W. You've reviewed 50+ ? :O That's very good. So you can read a lot of diffrent types of code. If you tell me only one vulnerability in the fixed code, I'll belive you and use a HTML sanitizer. See the link in my question.
Aug
12
comment Is it secure to use jQuery on the server-side for user input validation?
@drjimbob actually that's a good idea! When jQuery thinks it's text I'll do that.
Aug
12
comment Is it secure to use jQuery on the server-side for user input validation?
@D.W. the XSS cheat found no holes in my solution. But Hendrik Bummermann found some for IE. But now they're fixed.
Aug
12
comment Is it secure to use jQuery on the server-side for user input validation?
@drjimbob Look at the code in my update. I don't let anything pass when I don't know what it's. But if you guys really mean that it's unsafe I'll look for some kind of HTML sanitizer library for node.js
Aug
12
comment Is it secure to use jQuery on the server-side for user input validation?
I'm using jade in my website and jade has markdown support however I need to use HTML in this case. Look at my updated post if you're intrested in code.
Aug
12
revised Is it secure to use jQuery on the server-side for user input validation?
added 78 characters in body
Aug
12
accepted Is it secure to use jQuery on the server-side for user input validation?
Aug
12
comment Is it secure to use jQuery on the server-side for user input validation?
Intresting, I just made a few more testings with the information I got from the other answers and jQuery seams quite safe. So can you show me one subtle way to smuggle bad HTML into my HTML document? Btw it's not a browser which is parsing this it's JavaScript V8 in all cases.
Aug
12
awarded  Commentator
Aug
12
comment Is it secure to use jQuery on the server-side for user input validation?
OK perfect I'll test everything again and I'll fix css expression() and vb links with jQuery too.
Aug
12
comment Is it secure to use jQuery on the server-side for user input validation?
@HendrikBrummermann I've read the XSS sheet cheat a few times before already.
Aug
12
comment Is it secure to use jQuery on the server-side for user input validation?
So if jQuery supports broken HTML I can do this: userinput = $("<div>").html(userinput).each(dostuff).html() and then it's valid right?
Aug
12
comment Is it secure to use jQuery on the server-side for user input validation?
Isn't jQuery verifying that the HTML is valid and should I really care about vbs links?
Aug
12
comment Why do I get AV alerts when browsing a web page?
@HendrikBrummermann so could it also be some old vbs for ie in the js file?
Aug
12
awarded  Editor