Closed GoogleCodeExporter closed 9 years ago
Implemented using http://josephoconnell.com/java/xss-html-filter/
Also added xss filter for form values.
Original comment by kinyelo@gmail.com
on 10 Mar 2010 at 11:42
That did not work for the registration page. See attached screenshots.
Input was: "><script>alert("Bla");</script> in the name field.
If you want to go for the blacklist approach there is a huge regex file (part
of a PHP IDS system) which you could just check against:
https://svn.php-ids.org/svn/trunk/lib/IDS/default_filter.xml
New filters and attack vectors are discussed here:
http://sla.ckers.org/forum/read.php?12,30425,page=1
Original comment by mithan...@gmail.com
on 11 Mar 2010 at 9:41
Attachments:
I just checked svn code and it works good. Please checkout from svn.
Original comment by kinyelo@gmail.com
on 12 Mar 2010 at 7:57
Original issue reported on code.google.com by
mithan...@gmail.com
on 9 Mar 2010 at 9:36