Whoever it was that fixed the XSS (necro?), I'm impressed how fast that was.
But please don't rely on just escaping < and >. You have to worry about double-quotes too, I can end a string and add a "onload" or "onfocus" attribute if it's already in a tag. And sometimes you have to worry about single quotes. In fact, there's a lot to take a look at.
Instead of just fixing the case at hand, try to be proactive about it. Check to make sure you don't have anything else.
Yup. I actually wrote a filter to our framework when it was built years ago, but as new people help out on dev they don't always use the framework. My bad and I do appreciate the smack.
I humbly bow to you with egg on my face.
Comments
Whoever it was that fixed the XSS (necro?), I'm impressed how fast that was.
But please don't rely on just escaping < and >. You have to worry about double-quotes too, I can end a string and add a "onload" or "onfocus" attribute if it's already in a tag. And sometimes you have to worry about single quotes. In fact, there's a lot to take a look at.
Instead of just fixing the case at hand, try to be proactive about it. Check to make sure you don't have anything else.
Edit: Click the search box, for example. http://www.pinkbike.com/forum/search/?q=%22%20onclick=%22ale...
Yup. I actually wrote a filter to our framework when it was built years ago, but as new people help out on dev they don't always use the framework. My bad and I do appreciate the smack. I humbly bow to you with egg on my face.