Timeline for Is it possible to inject HTML into image to provoke XSS?
Current License: CC BY-SA 3.0
8 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Mar 17, 2017 at 13:14 | history | edited | CommunityBot |
replaced http://security.stackexchange.com/ with https://security.stackexchange.com/
|
|
| May 12, 2012 at 12:13 | comment | added | Hendrik Brummermann | The standard way to attack old internet explorers is to put the javascript code into the comment field of .gif files. | |
| S May 12, 2012 at 12:00 | history | suggested | lisa17 | CC BY-SA 3.0 |
grammar/spelling corrections
|
| May 12, 2012 at 9:46 | review | Suggested edits | |||
| S May 12, 2012 at 12:00 | |||||
| May 12, 2012 at 8:03 | comment | added | CodesInChaos | The second attack on the other hand is very tricky. Especially since a file can have several formats at the same time. For example there is a gif file, that's a jar(java archive) at the same time. The heuristics used by content sniffing are unclear too, making defense pretty hard. | |
| May 12, 2012 at 8:00 | comment | added | CodesInChaos | The first attack demonstrates why encoding on output is superior to sanitizing the input. Makes it much harder to miss such a case. | |
| May 12, 2012 at 7:02 | vote | accept | Andrei Botalov | ||
| May 11, 2012 at 20:16 | history | answered | dr jimbob | CC BY-SA 3.0 |