xss

问题 I have a page that receive via GET a base64 encoded data, it print data in an input hidden and it pass via get to another page. The problem is this: when i pass "Peuq/0X4XhFV+XNa8T06qFrP8lRadORUQBGJ1w6D4m33Jaqx/skKDEJIxjldBrcklboL/uB4C65cjz3BHMPmd3moEJ4GTK5k5Jwf9Ny4BA467bwgeaHJuOS+CjwFlIOzrhSWHTMVl4zWVvwMauuFAjhuMjOOj0/X5L12IcwGTTqLgHo" via GET it becomes "Peuq/0X4XhFV XNa8T06qFrP8lRadORUQBGJ1w6D4m33Jaqx/skKDEJIxjldBrcklboL/uB4C65cjz3BHMPmd3moEJ4GTK5k5Jwf9Ny4BA467bwgeaHJuOS

问题 After running a security scan across our web application (WebInspect), it has reported several XSS vulnerabilities with some aspx pages. The request URL seems to be able to change the form action. Example, /Website/somepage.aspx/'+alert(1234)+' the form action is changed to action="'+alert(1234)+'" To rule out our application code, I tried this with the default new Visual Studio webform project and it allows the same. How can this be prevented? I've always been told that un-validated input

问题 Given the code below, how do I use htmlpurifier to allow the entire contents to pass through. I want to allow the entire html document but the html,head,style,title,body and meta get stripped out. I even tried $config->set('Core.ConvertDocumentToFragment', false) but that didn't work. Any help on where to start would be greatly appreciated. I tried the example here HTML Purifier - Change default allowed HTML tags configuration but it doesn't work. I keep getting exceptions that the tags are

问题 In my web app is a config file which includes i.e. database connection settings ans is always loaded at the first line of a PHP script. I would like to include a function which cleans all POST and GET data for maybe existing XSS and SQL Injection risks. I am not sure if that function is really enough function make_safe($variable) { $variable = strip_tags(mysql_real_escape_string(trim($variable))); return $variable; } foreach ($_POST as $key => $value) { $_POST[$key] = make_safe($value); } /

问题 Say you have a text <INPUT> for a user's name and they decide to type in Johnny's Pizza This is saved in DB as Johnny's Pizza But if the user decides to edit, I repopulate the text <INPUT> as follows echo form_input('name', htmlspecialchars($name, ENT_QUOTES, 'UTF-8')); which will show as Johnny's Pizza inside the input field. PHP.net has a comment here suggesting to use echo form_input('name', htmlspecialchars($name, ENT_QUOTES, 'UTF-8', FALSE)); that is, FALSE referring to $double_encoding

问题 Is there anyway to limit Javascript Get, Post request to a specified domain? Also can I somehow disable JSONP? I want to develop a web content framework where people can include javascripts in different pages but I don't want those scripts to access any other domain. I am familiar with firefox "Content Security Policy" but unfortunately that is only applicable to firefox. 回答1: It's "disabled" by default. If you want to "allow" json, you would have to add jsonp callback. Without it, js isn't

问题 I have a literal control being used to display HTML coming from DB. I did face some XSS issues and implemented Anti-XSS Security Runtime Engine (SRE) to automatically encode all html markup. e.g. DB : <p align="center"></p> Anti-XSS encodes it as : <p align="center"> </p&#62 However, when I am setting text property of literal content from code behind, I was expecting that the literal control will DECODE the proper html and display the rendered version. Instead, it is showing the ENCODED

问题 I have a Contao 3.x website where I use CDN for the assets. The problem that gives rise to on the backend is that TinyMCE does not work anymore. I read that there is a different cdn js for loading TinyMCE with CDN, but on a Contao (or probably the same with any other CMS using TinyMCE), and especially the backend, something like that is auto configured by the system. I could try to make a core change inserting a script tag on the template, but that is not optimal at all and not what I am

问题 I'm creating my first Chrome extension, a relatively simple one with some ajax calls. My manifest is pretty simple: { "name": "Read It Now", "version": "0.12", "description": "Read it now.", "permissions": [ "https://readitlaterlist.com" ], "app": { "launch": { "local_path": "index.html" } } } I'm then using jQuery to fetch some simple data from a URL like: https://readitlaterlist.com/v2/get?state=unread&count=10&apikey=xxx&username=yyy&password=zzz However, Chrome still rejects it:

问题 How does the XSS (Cross Site Scripting) support provided by ASP.net differs from AntiXss. AntiXss is a microsoft library for securing your site against XSS. Both API looks almost similar and it looks that they can easily be switched from one to another by doing find replace in your code files. Which one provides more security against XSS? Is it advicable to use the intrinsic support provided by ASP.net? 回答1: There are several differences. First of all the Microsoft AntiXss library uses white