Comment on XSS Twitter in minutes; Why you shouldn't store important data with 37signalsparentComments−Manfred17yIt's probably better to disable the JavaScript engine based on certain heuristics, for instance when there is invalid character encoding in attributes.−tptacek17yThat won't work, because too much "safe" user-controlled content will contain invalid utf8.
Comments
It's probably better to disable the JavaScript engine based on certain heuristics, for instance when there is invalid character encoding in attributes.
That won't work, because too much "safe" user-controlled content will contain invalid utf8.