Search Results

Search found 497 results on 20 pages for 'xss prevention'.

Page 7/20 | < Previous Page | 3 4 5 6 7 8 9 10 11 12 13 14  | Next Page >

• Pros and Cons of Java HTML to XML cleaners

  - by cjavapro

  I am looking to allow HTML emails (and other HTML uploads) without letting in scripts and stuff. I plan to have a white list of safe tags and attributes as well as a whitelist of CSS tags and value regexes (to prevent automatic return receipt). I asked a question: Parse a badly formatted XML document (like an HTML file) I found there are many…

  Read the article

• align WMD editor's preview HTML with server-side HTML validation (e.g. no embedded javascript)

  - by Justin Grant

  There are many SO questions (e.g. here and here) about how to do server-side scrubbing of Markdown produced by the WMD editor to ensure the HTML generated doesn't contain malicious script, like this: <img onload="alert('haha');" src="http://www.google.com/intl/en_ALL/images/srpr/logo1w.png" /> This doesn't affect the WMD client's…

  Read the article

• Sanitize HTML before storing in the DB or before rendering? (AntiXSS library in ASP.NET)

  - by user102533

  I have an editor that lets users add HTML that is stored in the database and rendered on a web page. Since this is untrusted input, I plan to use Microsoft.Security.Application.AntiXsSS.GetSafeHtmlFragment to sanitize the HTML. Should I santiize before saving to the database or before rendering the untrusted input into the webpage? Is there…

  Read the article

• Using jQuery to disable CSS inheritance

  - by Buzzedword

  Is there a way to use jQuery (or generic javascript) to disable CSS inheritance on a block level? For example, if I am pulling in an external resource via javascript, say pastie.org, they will have their own CSS that my CSS overrides. I would like to place the embed code into its own container that has CSS inheritance disabled. This is not…

  Read the article

• Microsoft AntiXSS in Medium Trust :Error

  - by aramugam

  I want to include Microsoft AntiXss V1.5 library on my live site running in a medium trust setting.However, I got an error something like: Required permissions cannot be acquired. Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error…

  Read the article

• Cross-Origin Resource Sharing (CORS) - am I missing something here?

  - by David Semeria

  I was reading about CORS (https://developer.mozilla.org/en/HTTP_access_control) and I think the implementation is both simple and effective. However, unless I'm missing something, I think there's a big part missing from the spec. As I understand, it's the foreign site that decides, based on the origin of the request (and optionally…

  Read the article

• Rails 2.3.5 with rails_xss escaping content_for yielded content

  - by DEfusion

  Just upgraded Rails to 2.3.5 to get the lovely looking rails_xss plugin but I've noticed one big issue with it. Any content_for blocks are escaped when yielded. I've tried hacking it around by doing the either of following but they do not work: <% @content_for_foo.html_safe! -%> <%= yield raw :foo %>

  Read the article

• Access to restricted URI denied code: 1012

  - by Jimmy Chandra

  How do you get around this Ajax cross site scripting problem on FireFox 3?

  Read the article

• Security considerations processing emails

  - by Timmy O' Tool

  I have process that will be reading emails from an account. The objective of the process is saving to a database those emails with image(s) as attachments. I will be saving sender, subject body and image path (the image will be saved on the process). I will be showing this information on a page so I would like to know all (or most…

  Read the article

• Ajax - Asynchronous request problem

  - by newprog

  When doing an AJAX call, why do browser security rules state that you cannot make a request to a different domain?

  Read the article

• How to assign the value of document.cookie to your browser cookies?

  - by Ricket

  I'm a developer (and therefore a tester) of a website. Our site accepts any JavaScript or HTML from an user but I haven't been successful in explaining the danger of it, as obvious as it is. So I would like to prove it by logging in as my boss to prove to him that there is definitely a real danger here. I think this will put down…

  Read the article

• How to prevent a specific directory from running Php, Html, and Javascript languages?

  - by Emily

  Hi, Let's say i have an image uploader script, i want to prevent the upload directory from executing Php or even html by only showing it as plain text, i've seen this trick in many websites but i don't know how they do it. Briefly, if i upload evil.php to that directory, and i try to access it i will only see a plain text source…

  Read the article

• How good is the Rails sanitize() method?

  - by Horace Loeb

  Can I use ActionView::Helpers::SanitizeHelper#sanitize on user-entered text that I plan on showing to other users? E.g., will it properly handle all cases described on this site? Also, the documentation mentions: Please note that sanitizing user-provided text does not guarantee that the resulting markup is valid …

  Read the article

• Passing XML data and user from coldfusion page to .NET page

  - by Mark Rullo

  I'd appreciate some input on this situation, I can't figure out the best way to do this. I have some data that's being prepared for me in a ColdFusion app and in an IFrame within the CF app we want to display some graphs (not strictly an image, it's an entire page) being generated on the .NET side of things. I'd like to…

  Read the article

• Codeigniter xss_clean dilemma

  - by Henson

  I know this question has been asked over and over again, but I still haven't found the perfect answer for my liking, so here it goes again... I've been reading lots and lots polarizing comments about CI's xss_filter. Basically majority says that it's bad. Can someone elaborate how it's bad, or at least give 1 most…

  Read the article

• What's the best Open Php newsletter manager ?

  - by Bilel

  Hi :) I'm looking for a nice newsletter management solution. I tried CCmail a good script but whaere I can't imort usernames !!! I would like to find a system that is able to import Opt-in lists in the following format : John Smith;Jsmith@johnny.com;other paramaeters...;[like] ;Male;Age... I will develop my own…

  Read the article

• Website Vulnerabilities

  - by Ben Griswold

  The folks at the Open Web Application Security Project publish a list of the top 10 vulnerabilities. In a recent CodeBrew I provided a quick overview of them all and spent a good amount of time focusing on the most prevalent vulnerability, Cross Site Scripting (XSS).  I gave an overview of XSS, stepped…

  Read the article

• Dealing with HTTP w00tw00t attacks

  - by Saif Bechan

  I have a server with apache and I recently installed mod_security2 because I get attacked a lot by this: My apache version is apache v2.2.3 and I use mod_security2.c This were the entries from the error log: [Wed Mar 24 02:35:41 2010] [error] [client 88.191.109.38] client sent HTTP/1.1 request without…

  Read the article

• Spam Activity From my computer

  - by Bnymn

  I'm using Ubuntu 12.04 64bit. I'm using HTTP proxy over ssh as mentioned here. If I do not start TinyProxy, everything is OK. But, when I start TinyProxy, I'm getting the following. I think there is an application running on my machine and watching the proxy to start. But I could not decide which one it…

  Read the article

• Sometimes this script fails to update the iptables

  - by AlJo

  It does not happen often, but sometimes after running the below script, checking the iptables with service iptables status shows that they weren't updated and the script doesn't output any error. The iptables is structured as look-up tree (long repeated sections snipped): #!/bin/sh iptables -t nat -F…

  Read the article

• What sources do spammers use to get email addresses?

  - by Andrew Grimm

  From what sources do email spammers get their addresses? Wikipedia mentions the following: Harvesting email addresses from publicly available sources. This includes web pages (web crawling), usenet posts, mailing list archives, DNS and WHOIS records Guessing email addresses (directory harvest…

  Read the article

• Why is my own e-mail address not listed in the To field?

  - by Sammy

  I have received a suspicious e-mail. I am not affiliated with the company mentioned in the e-mail body, or the signer. However, I have been using the app they mention in the e-mail. They are inviting me to a Beta test. But the e-mail is not by the original author of the app. But I'm thinking they…

  Read the article

• Preventing Postfix backscattering

  - by Must Do Better

  I am having problems with the Postfix mail server being used for backscattering, I have tried the suggestions in the manual but nothing seems to work. Does anyone know how we can reject any mail from entering the queue if the recipient doesn't match a local recipient rather than send bounce…

  Read the article

• Project Honey Pot - mod_httbl

  - by Henko

  I'm very interested in project honey pot. It seems like a smart way of blocking harversters etc from your web server. I found out about mod_httpbl for apache but I haven't find much to read about it other than on project honey pot's homepage. Doesn't seem like a very active project(?) …

  Read the article

• Prevent Server Restart after Windows Updates

  - by eidylon

  we have a number of servers in our office, as a small hosting company, and these servers are critical to business, ... web server, mail server, db server, etc. On a semi-regular basis, when the machines get automatic updates, they just automagically reboot themselves in the middle of…

  Read the article

< Previous Page | 3 4 5 6 7 8 9 10 11 12 13 14  | Next Page >