4 ms·
Why is blacklisting not safe, assuming you contextually blacklist?
by bennofs 10y ago
Why is blacklisting not safe, assuming you contextually blacklist?
- strommen 10y agoRead this: https://stackoverflow.com/questions/5696244/is-escaping-and-sufficient-to-block-xss-attacks https://stackoverflow.com/questions/5696244/is-escaping-and-...
- moloch 10y agoThere are a huge number of contextual corner cases, this cheat sheet lists just a few: https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_She...
- tedunangst 10y agoI don't understand what that page is trying to tell me. What is the "filter" that <body onload=alert()> evades?