4 ms·
The Microsoft/IE8 approach was fundamentally flawed and lead to XSS attacks in otherwise-safe sites [1]. The approach in this article only ever prevents executi
by ghusbands 11y ago
The Microsoft/IE8 approach was fundamentally flawed and lead to XSS attacks in otherwise-safe sites [1]. The approach in this article only ever prevents execution without otherwise changing behaviour (modulo noted bugs and slowdown), improving security.
However, developers may start accidentally depending on this security feature and hence make sites less secure in browsers lacking the feature. If the taint is hit, there should instead be a big red warning, akin to safe browsing or https warnings.
[1] http://www.zdnet.com/article/security-gone-awry-ie-8-xss-filter-exposes-sites-to-xss-attacks/ http://www.zdnet.com/article/security-gone-awry-ie-8-xss-fil...
- ubernostrum 11y agoIf I'm remembering correctly, Microsoft later changed it from trying to "sanitize" the suspicious content to just flat refusing to render the page when it detects reflected content. I'm interested in pros/cons of the reflection-detecting vs. taint-tracking approaches, not about different approaches to actions taken post-detection (which is where the initial IE8 approach fell over).