whitelist

.NET HTML whitelisting (anti-xss/Cross Site Scripting)

倖福魔咒の 提交于 2019-11-28 01:12:12
问题 I've got the common situation where I've got user input that uses a subset of HTML (input with tinyMCE). I need to have some server-side protection against XSS attacks and am looking for a well-tested tool that people are using to do this. On the PHP side I'm seeing lots of libraries like HTMLPurifier that do the job, but I can't seem to find anything in .NET. I'm basically looking for a library to filter down to a whitelist of tags, attributes on those tags, and does the right thing with

Phonegap/Cordova whitelisted cross domain SSL request not working after exporting APK

£可爱£侵袭症+ 提交于 2019-11-27 16:47:18
问题 I have created a phonegap app which needs to communicate with a self signed SSL service. I whitelisted my url in res/xml/cordova.xml like so: <access origin="https://www.mydomain.com" subdomains="true" /> and this works fine when I run and build from eclipse but if I then export and sign my app and manually install the APK then the app is unable to communicate with my web service. The communication with the server is carried out using the Sencha Touch library like so: Ext.Ajax.request({ url:

Google CCS (GCM) - project not whitelisted

旧巷老猫 提交于 2019-11-27 16:26:44
问题 I'm trying to get the Python code working that I found on: http://developer.android.com/google/gcm/ccs.html I've change the first 2 rows with (I think) the correct data. The projectnr and api key is fake, it's just to show you how it almost looks. import sys, json, xmpp SERVER = ('gcm.googleapis.com', 5235) USERNAME = '489713985816' PASSWORD = 'AIzd237jjN_iT7yRxLWiHRreqax45XaMJQ6VJ98' I've created a google api project (tried it with 2 different projects). Activated GCM. Copied the following:

What is the state of whitelisting in phonegap 1.3.0?

允我心安 提交于 2019-11-27 14:51:40
Does phonegap/callback/cordova have a whitelist on all platforms? Is it implemented the same way on each? Peter Ehrlich The whitelist is present on both iOS and Android, but not other platforms yet. Under iOS , it goes under the name of "External Hosts," which is explained here: http://wiki.phonegap.com/w/page/41631150/PhoneGap%20for%20iOS%20FAQ Q. Links to and imported files from external hosts don't load? A. The latest code has the new white-list feature. If you are referencing external hosts, you will have to add the host in PhoneGap.plist under the "ExternalHosts" key. Wildcards are ok. So

Allow user submitted HTML in PHP

大城市里の小女人 提交于 2019-11-27 09:10:16
I want to allow a lot of user submitted html for user profiles, I currently try to filter out what I don't want but I am now wanting to change and use a whitelist approach. Here is my current non-whitelist approach function FilterHTML($string) { if (get_magic_quotes_gpc()) { $string = stripslashes($string); } $string = html_entity_decode($string, ENT_QUOTES, "ISO-8859-1"); // convert decimal $string = preg_replace('/&#(\d+)/me', "chr(\\1)", $string); // decimal notation // convert hex $string = preg_replace('/&#x([a-f0-9]+)/mei', "chr(0x\\1)", $string); // hex notation //$string = html_entity

Error: Whitelist rejection in Phonegap

邮差的信 提交于 2019-11-27 08:59:59
I'm new to mobile development. I'm using Phonegap/Cordova to create a cross-platform app. My code works well on Android but when I'm porting it to iPhone it's showing an error: [143:2003] ERROR whitelist rejection: url="abc" Now can I overcome this problem? Notice : This answer only applies for PhoneGap version 1.x and below. From version 2.x onwards, whitelist configuration is done via cordova.xml . You have to add allowed URLs into PhoneGap.plist's (or Cordova.plist) ExternalHosts array. For example, if you want to allow access to this URL http://www.myhost.com/path/file , then add www

Google App Engine - list of IP addresses?

隐身守侯 提交于 2019-11-27 05:42:58
问题 I know that Google App Engine does not support an application having a static IP address, but I'd like to know if there is a list or range of IP addresses that an app could potentially have? I'd like to use that list as a whitelist of IP addresses for another application deployed elsewhere. 回答1: In addition to the other answers, GAE premier support directed me to this name, esp as the source IP address for URLFetch calls: $ dig -t txt _cloud-netblocks.googleusercontent.com which answers:

Why use a whitelist for HTML sanitizing?

六眼飞鱼酱① 提交于 2019-11-27 04:45:59
问题 I've often wondered -- why use a whitelist as opposed to a blacklist when sanitizing HTML input? How many sneaky HTML tricks are there to open XSS vulnerabilities? Obviously script tags and frames are not allowed, and a whitelist would be used on the fields in HTML elements, but why disallow most of everything? 回答1: If you leave something off a whitelist, then you just break something that wasn't important enough for you to think about in the first place. If you leave something off a

How do I add a type to GWT's Serialization Policy whitelist?

你说的曾经没有我的故事 提交于 2019-11-27 03:34:33
GWT's serializer has limited java.io.Serializable support, but for security reasons there is a whitelist of types it supports. The documentation I've found, for example this FAQ entry says that any types you want to serialize "must be included in the serialization policy whitelist", and that the list is generated at compile time, but doesn't explain how the compiler decides what goes on the whitelist. The generated list contains a number of types that are part of the standard library, such as java.lang.String and java.util.HashMap . I get an error when trying to serialize java.sql.Date , which

IP Address Block of Appengine Servers?

前提是你 提交于 2019-11-27 02:16:14
问题 I'm working with a third party webservice who requires that all calls to their service are made from whitelisted IP addresses. That is, I must give them IP addresses from which I will be making calls to their service. Problem is I'm using Google Appengine. Is there any way to get a static IP address when making outgoing http requests from Appengine? Failing that - is there a block of IP addresses that all requests will come from? I could get the entire bloc whitelisted. If this exists, how