XSS: Welcome to 2003 (or thereabouts) [ajaxian.com]
Ajaxian mentions SafeErb for Rails, an add-on to help secure that user input is safe. It does so by checking if you explicitly call a certain method to escape the user content.
OpenACS, the base for .LRN, has been doing this for awile now. We took a different approach. All content is escaped by default, and the programmer must decide when to let through unescaped content. Either way it's something all Web frameworks should support if they allow users to enter HTML.
Recent Entries
Categories
AJAX (13)
Blogging (10)
Business (4)
CCK08 (1)
Facebook (5)
MEL (16)
Open Learning (8)
OpenACS / .LRN (21)
LAMS (4)
PostgreSQL (1)
Programming (16)
Tech (13)
Authors
Caroline Meeks (109)
Dave Bauer (40)
Deds Castillo (7)
Hamilton Chua (17)
Pauline Castillo (5)
Arnel Estanislao (3)
Archive
Notifications
You may request notification for Solution Grove Blog.
Syndication Feed
Recent Comments
- thanks
- Using clickpass
- Should we put this on Solutiongrove.com, .net, .info??
- How about redirecting users to setup password for elgg
- Great job!
- Bandwidth (the human kind)
- ns_zlib on OpenACS
- Thanks Mark
- svnmerge.py saves you the pain
- Mosio, Yahoo Answers on Mobile ?
Technorati Blogs