lmorchard - Pebbling Club 🐧🪨

Google Online Security Blog: Reducing XSS by way of Automatic Context-Aware Escaping in Template Systems

googleonlinesecurity.blogspot.com
2009-04-14T15:09:21.000Z
security webdev xss templating imported:pinboard

Feed

Unfurl

{ "failed": true, "failedAt": 1728195527395, "failedError": "TimeoutError: Promise timed out after 10000 milliseconds", "expires": 1728365890491, "status": 200, "bodyLength": 139373, "author": "Google", "date": "2009-03-31T12:00:00.000Z", "description": "Posted by Jad S. Boutros, Security Team Building on our earlier posts on defenses against web application flaws [ “Automating Web Applicatio…", "image": "https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjYIUyQJtaAY06QUHFJwNJq_G2-GyovxH4kqwBEFS_WweUghi5Qkid_Mrt9Qa65XBQ254P_EMWHpRQWIV17U_oQgEyStBSHWel9v8hHlWeP4ncr9BBtfD6QUhjhPlcISln2jWWNWgf2Ol-P/s1600/googlelogo_color_200x200.png", "logo": "https://security.googleblog.com/favicon.ico", "publisher": "Google Online Security Blog", "title": "Reducing XSS by way of Automatic Context-Aware Escaping in Template Systems", "url": "https://security.googleblog.com/2009/03/reducing-xss-by-way-of-automatic.html", "feed": "https://security.googleblog.com/feeds/posts/default?alt=rss", "lang": "en", "duration": 7876 }
Filtering & Escaping Cheat Sheet - Pixelated Dreams

pixelated-dreams.com
2007-08-31T18:56:07.000Z
php security xss imported:pinboard

Notes

Nice cheat sheet, but looking at the semi-random names of all these functions it's no wonder that this stuff isn't just natural.

Unfurl

{ "failed": true, "failedAt": 1728195627478, "failedError": "TimeoutError: Promise timed out after 10000 milliseconds" }
Chris Shiflett: My Top Two PHP Security Practices

shiflett.org
2007-08-31T18:53:26.000Z
php security xss webdev imported:pinboard

Notes

"I have decided to promote my Top Two PHP Security Practices, expressed in four words: Filter input Escape output"

Unfurl

{ "failed": true, "failedAt": 1728195627478, "failedError": "TimeoutError: Promise timed out after 10000 milliseconds" }
PHP: Filter Functions - Manual

us2.php.net
2007-08-21T06:40:56.000Z
php xss security imported:pinboard

Notes

"This extension serves to validate and filter data coming from some insecure source, such as user input."

Unfurl

{ "failed": true, "failedAt": 1728195627515, "failedError": "TimeoutError: Promise timed out after 10000 milliseconds" }
Ned Batchelder: Xss with utf-7

www.nedbatchelder.com
2007-04-22T07:15:00.000Z
xss webdev utf-7 ugh imported:pinboard

Notes

"The resulting page doesn't have any explicit declaration of its character set, so depending on your browser settings, the browser may try to auto-detect the character set, and seeing the distinctive UTF-7 byte sequences, will choose UTF-7. In UTF-7, the

Unfurl

{ "failed": true, "failedAt": 1728195647526, "failedError": "TimeoutError: Promise timed out after 10000 milliseconds" }
dtm: Most HTML templating languages are written incorrectly

dtm.livejournal.com
2007-04-15T22:18:48.000Z
webdev html templating xss security imported:pinboard

Notes

"the problem with virtually every HTML templating language out there is that they make it easier for the person writing HTML templates to add an XSS hole than to avoid it."

Unfurl

{ "failed": true, "failedAt": 1728195657388, "failedError": "TimeoutError: Promise timed out after 10000 milliseconds" }

0 - 50 of 6 items

10 25 50 100 250