GWT HTML widget security risks

Posted by h2g2java on Stack Overflow See other posts from Stack Overflow or by h2g2java
Published on 2010-03-15T07:57:00Z Indexed on 2010/03/15 7:59 UTC
Read the original article Hit count: 257

Filed under:

gwt

|

html-widget

|

security-risks

In GWT javadoc, we are advised

If you only need a simple label (text, but not HTML), then the Label widget is more appropriate, as it disallows the use of HTML, which can lead to potential security issues if not used properly.

I would like to be educated/reminded about the security susceptibilities? It would be nice to list the description of the mechanisms of those risks.

Are the susceptibilities equally potent on GAE vs Amazon vs my home linux server?
Are they equally potent across the browser brands?

Thank you.

© Stack Overflow or respective owner

Related posts about gwt

How to include an external jar in gwt client side?

as seen on Stack Overflow - Search for 'Stack Overflow'
I would like to use the org.apache.commons.validator.GenericValidator class in a view class of my GWT web app. I have read that I have to implicitely tell that I intend to use this external library. I thought adding the next line into my App.gwt.xml would work. <inherits name='org.apache.commons… >>> More
How to include an external jar in a GWT module?

as seen on Stack Overflow - Search for 'Stack Overflow'
I would like to use the org.apache.commons.validator.GenericValidator class in a view class of my GWT web app. I have read that I have to implicitely tell that I intend to use this external library. I thought adding the next line into my App.gwt.xml would work. <inherits name='org.apache.commons… >>> More
GWT Javascript Exception in Hosted Mode: Result of expression 'doc.getBoxObjectFor' [undefined] is

as seen on Stack Overflow - Search for 'Stack Overflow'
Anyone ever seen this exception? I'm running in hosted mode on GWT 1.6.4 on a mac. I'm using the AutoSuggest and it's throwing this exception trying to show the popup. It works fine in compiled mode, but obviously hosted mode is rather important. [ERROR] Uncaught exception escaped com.google.gwt… >>> More
error when I use GWT RPC

as seen on Stack Overflow - Search for 'Stack Overflow'
Hello everyone... I have a problem with Eclipse when I use an RPC.. If I use a single method call it's all in the right direction but if I add a new method to handle the server I get the following error: com.google.gwt.core.client.JavaScriptException: (null): null at com.google.gwt.dev.shell… >>> More
GWT - occasional com.google.gwt.user.client.rpc.SerializationException

as seen on Stack Overflow - Search for 'Stack Overflow'
Hello we are haunted by occasional occurences of exceptions such as: com.google.gwt.user.client.rpc.SerializationException: Type 'xxx' was not assignable to 'com.google.gwt.user.client.rpc.IsSerializable' and did not have a custom field serializer.For security purposes, this type will not be… >>> More

Related posts about html-widget

GWT HTML widget security risks

as seen on Stack Overflow - Search for 'Stack Overflow'
In GWT javadoc, we are advised If you only need a simple label (text, but not HTML), then the Label widget is more appropriate, as it disallows the use of HTML, which can lead to potential security issues if not used properly. I would like to be educated/reminded about the security… >>> More
html widget communicating with server

as seen on Stack Overflow - Search for 'Stack Overflow'
I'm making html widget for websites. Let's say, it will display current stock indexes. In short, arbitrary website owner takes code snippet from me and includes it on his webpage http://website.com/index.html. When arbitrary user opens http://website.com/index.html, my code sends request to my server… >>> More
How to update a Blogger HTML widget through API ??

as seen on Stack Overflow - Search for 'Stack Overflow'
Can someone please tell me how to update a blogger HTML widget through php API ?? >>> More
What Patterns Should I Consider For a Html Widget Generator?

as seen on Stack Overflow - Search for 'Stack Overflow'
I'm looking to see if I can design a HtmlHelper extension method that will generate the Html for different types of widgets I want to produce. Each different type of widget implements functionality to get and prepare any data it needs to render. Can anyone suggest any patterns I could refer to… >>> More
Wordpress and Widget using TinyMCE

as seen on Stack Overflow - Search for 'Stack Overflow'
I have written a Text/HTML widget that uses TinyMCE to allow some basic formatting. However, when I save the changes, the data in the textarea is not getting posted. If I use just a simple textarea without TinyMCE then I can save the data properly. Any ideas? >>> More