Re: [Full-disclosure] strip_tags() but not only vulnerability

Tõnu Samuel wrote:
Many websites are still vulnerable and similar problems happen not depending
on programming language too often:
http://www.jes.ee/~tonu/strip.php

yes, if you use strip_tags() with the whitelist argument the whitelisted
tag can be misused.. the php manual warns you about this, so no news..

note that strip_tags() isn't the right function to use against xss (use
regexpr, htmlentities() or htmlspecialchars() instead)

the solution is:
$foo = htmlentities(strip_tags($foo));

or just:
$foo = htmlentities($foo);

if you need to "white list" some tags use an alias (like [b]bold[/b],
etc) and then str_replace (as done by many web applications)

tonu: imho this thread is well suited for webappsec but not for fd or
bt, also can you remove the word "vulnerability" from the subject of
this type of mails?

don't misunderstand me, i like informative mails and yours efforts, just
post on the right mailing list : )

regards, ascii, http://www.ush.it

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Relevant Pages

  • Question on titles in ipf files and help instances
    ... If I set this in a document to "foo", ... Now in a C program I wish to use that help file, ... tag has? ... If it is set to an empty string then the ...
    (comp.os.os2.programmer.misc)
  • Re: how to set attribute "name"
    ... successfully do this is nonstandard and extremely bad practice. ... 'foo' on Firefox 2.0.0.6 on Linux. ... return function (tag, name) { ...
    (comp.lang.javascript)
  • Re: XML Schema Definitions
    ... Now I would like to express, by using an XSD, the following restriction ... id attribute of some previously defined tag. ... then you define a keyref for the foo element so that the type attribute on foo is a key reference. ... If those id attributes are unique in the complete XML document then you could also use xs:ID as the id attribute type for your type element and xs:IDREF for the foo attributes. ...
    (comp.text.xml)
  • file included with jsp:include doesnt get parameters
    ... I have this example (jsp 2.0): ... the expression in mypage doesn't evaluate to any value. ... and foo is there for sure in some_file.jsp. ... i also tried to include from a tag, using pageContext.include, same ...
    (comp.lang.java.programmer)
  • Re: return array of strings to class
    ... Class Foo { ... Foo foo = new Foo; ... Java is similar to just about every programming language in widespread use today. ...
    (comp.lang.java.help)