tungwaiyip.info

home

about me

links

Media

Yucatán Photos

St Lucia Photos

Photo Album

Videos

Blog

< July 2004 >
SuMoTuWeThFrSa
     1 2 3
4 5 6 7 8 910
11121314151617
18192021222324
25262728293031

past articles »

Click for San Francisco, California Forecast

San Francisco, USA

 

Checking for Cross-Site Scripting Vulnerability

Netcraft.com brings my attention to cross-site scripting security problem. I have examined this website for vulnerabilities. This problem is usually caused by systems not checking input received from user or third party before using it. One place this website receives input is the RSS new feeds. I have crafted a test RSS with embedded javascript. Some RSS feeder (including this website) display the content as is. They should have (arguably) strip off the embedded script before displaying it. I promptly plugged this by escaping the meta characters before outputting them on the web pages.

An important element for cross-site scripting is that a third party can use a reputable website as a conduit to inject questionable code in their context. In this case the news feeder's communication is only between this website and the news source. I am not aware of any loop hole for third party to get involved. But in the world of open communication it is better to be safe to test for all input before use.

2004.07.20 [, ] - comments

 

 

blog comments powered by Disqus

past articles »

 

BBC News

 

Trump signs order undoing Obama climate change policies (28 Mar 2017)

 

Cyclone Debbie: Australia activates disaster response plan (28 Mar 2017)

 

Cyclone Debbie seen from space (28 Mar 2017)

 

Turkey 'spied' on pro-Gulen opponents in Germany (28 Mar 2017)

 

New population of rare tigers found in eastern Thailand (28 Mar 2017)

 

Paris clashes after French police kill Chinese man (28 Mar 2017)

 

Carlos the Jackal : Third French life sentence for notorious militant (28 Mar 2017)

 

Sweden reacts to anger at 'risky births' and maternity care shortages (28 Mar 2017)

 

Kasai unrest: UN experts 'found dead' in DR Congo (28 Mar 2017)

 

Winnie Madikizela-Mandela on Kathrada: 'Same pain as Mandela' (28 Mar 2017)

more »

 

SF Gate

 

Bay Area News (7 Jan 2012)

 

City Insider (11 Feb 2012)

 

Crime Scene (13 Feb 2012)

 

C.W Newius Column (10 Jan 2012)

 

C.W. Nevius Blog (11 Feb 2012)

 

Education News (10 Jan 2012)

 

KALW (11 Feb 2012)

 

Matier and Ross Blog (11 Feb 2012)

 

United’s leggings, Samsung’s Bixby and London’s luxury rentals (27 Mar 2017)

 

Uber resumes self-driving car program after brief suspension (27 Mar 2017)

 

Mission Beach Cafe sued by workers claiming wage violations (27 Mar 2017)

 

Panel grapples with pot banking laws (27 Mar 2017)

 

Business News Roundup, March 28 (27 Mar 2017)

 

Shiptraffic, March 28 (27 Mar 2017)

more »

 


Site feed Updated: 2017-Mar-28 12:00