sanitize() and blacklists
Tuesday, July 3, 2007 at 2:56PM This is Rails' sanitize method:
sanitize(html)
Sanitizes the html by converting <form> and <script> tags into regular text, and removing all "onxxx" attributes (so that arbitrary Javascript cannot be executed). It also removes xhref= and xsrc= attributes that start with "javascript:".
This is a blacklist method which removes potential harmful JavaScript. As I said before, blacklist filter are never complete and filter only the most basic cross-site scripting attacks, there will always be special code which works fine in some browsers, even though you have used a filter. Examples are here, here and here (list != infinite). Here are some other examples that pass through sanitize and execute in IE (mostly v6) or Firefox:
- <IMG _src="javascript:alert(String.fromCharCode(88,83,83));">
- <DIV STYLE="background-image: url(javascript:alert(1))">
- <div style="width: expression(alert(1))">hello</div>
- <INPUT TYPE="IMAGE" _src="javascript:alert(1);">
I will not post these examples as a ticket, because I think fixing a blacklist is rather useless. As DHH said in one of the tickets, sanitize in that form is kind of deprecated, a whitelist filter is definitely better. I recommend not to use sanitize until it is being converted to a whitelist filter.
This is RSnake's famous XSS Cheat Sheet.
View Printer Friendly Version
Email Article to Friend
Reader Comments (197)
RSS have a design that make it easy to generate and fun for webmasters, but it's a hell for anyone that must write a feed consumer.Here is some links about html sanitization in Ruby on Rails.Links:Sanitize HTML in RubySanitize HTML to prevent XSS and ...
nice post...
sanitize() and blacklists...
c682t
c460t
nice post...
wafer?crowning!Dave?cheap auto insurance with no down payment [url=http://www.webfir.com/13273.html]cheap auto insurance with no down payment[/url] http://www.webfir.com/13273.html ...
unlawful alas bray Trevelyan deteriorate:inductee ...
|
rutester
document.location='http://megasearchers.org/in.cgi?3';
s
what is amaryl and side effects
buy generic cialis without credit cards
buy generic cialis without prescription
buy now cialis
buy online cialis
buy online levitra cialis viagra
buy prescription cialis
buy prescription cialis online
buy soft cialis
buy softtabs cialis
buy sublingual cialis online
buy tadalafil cialis
uy cialis without a prescription
buy generic cialis online
buy generic cialis overnight delivery
buy generic cialis softtabs
buy generic cialis softtabs cheap
buy generic cialis softtabs online
buy generic cialis uk
http://cardura10.freetzi.com
Cardura is in a group of drugs called alpha-adrenergic blockers. Cardura causes the blood vessels (veins and arteries) to relax and expand, improving blood flow. Cardura also relaxes muscles in the prostate and bladder neck, making it easier to urinate.
Cardura is used to treat hypertension (high blood pressure) and benign prostatic hyperplasia (enlarged prostate).
Cardura may also be used for purposes other than those listed in this medication guide.
http://kamagrasuite.bravehost.com
Cardura
1 cardura
2 cardura
4 cardura
5 sildenafil and cardura
best price for cardura generic
can cardura be used with asthma
cardura
cardura 2 mg
cardura 4
cardura 4 mg
cardura 40
cardura 4mg
cardura 8 mg
cardura 8mg
cardura and flomax comparison dosing
cardura and flomax conversion dosing
cardura and flomax dosing
cardura and flomax ion dosing
cardura and prostate
cardura and sinuses
cardura bladder constriction
cardura bladder problem
cardura bladder treatment
cardura blood pressure
cardura bph
cardura bronchospasm
cardura car seat covers
cardura car wax
cardura contradictions
cardura cramps
cardura doxazosin
cardura doxazosin mesylate side effects
cardura drug
cardura drug information
cardura drug interaction
cardura edema
cardura effect on renal blood flow
cardura effects on lipids
cardura effects side
cardura flash drive drivers
cardura for bph
cardura for urinary retention
cardura generic
cardura insert package
cardura jackets
cardura lawsuit side effects
cardura long term effects
cardura med what is it for
cardura medication
cardura medicine
cardura medicine identification
cardura moa
cardura n10
cardura on line
cardura online
cardura palmetto saw together
cardura patent expiration
cardura pharmacology
cardura prostate
cardura renal blood flow
cardura sexual side effects
cardura shelf life conditions
cardura side affects
cardura side effects
cardura stop sweating
cardura tablet
cardura tablets
cardura tube
cardura usage in bph
cardura use
cardura uv curing
cardura vs flomax dosing
cardura what is it
cardura with flomax
cardura xl
cardura xl 8
cardura xl 8mg
cardura xl doxazosin
cardura xl flash drive software driver
cardura xl flash drive specs
cardura xl pfizer
cardura xt
cheap cardura at online pharmacy
diovan cardura tenormin and calan combination
doxazosin cardura
drug cardura
epinephrine vs cardura
find the medicine cardura or doxazosin
flomax cardura
flomax vs cardura
flomax with cardura
generic cardura doxazosin
hytrin vs cardura
is cardura safe contrindicated with asthma
is cardura safe with asthma
is epinephrine and cardura the same
johns hopkins uroxatrol cardura compare
medication cardura
older cardura
pediatric indications for cardura
period cardura
side effects from cardura
side effects of cardura
sildenafil and cardura
singulair terazosin foradil actos cardura
viagra and cardura interaction
what is another name for cardura
what is cardura
what is cardura for
what is cardura xl
kamagra,cheap kamagra, jelly kamagra, kamagra plus, jelly kamagra oral,
kamagra uk, buy kamagra, kamagra tablet, buy kamagra online, kamagra st,
fast kamagra, buy kamagra uk.
Viagra, Cialis, Viagra Professional, Cialis Professional, Viagra Soft
Tabs, Cialis Soft Tabs, Levitra, Kamagra, Viagra Jelly, Cialis Jelly,
Propecia, Himplasia, Cardura, Yohimbe-1200, Eulexin, Speman, Pro-Erex,
Casodex, Hytrin, Flomax, Urispas, Tentex Royal, Horny Goat Weed, Ginseng,
Saw Palmetto, Proscar, Maxaman, Erexor, Avodart, Himcolin, Confido,
Uroxatral, Herbal Testosterone.
http://cardura10.freetzi.com
[b] Naughty blonde babe Jana Jordan [/b]
[url=http://82.146.59.200/go.php?sid=2][img]http://fapomatic.com/thumbs/0810/girlfriend10.jpg[/img][/url]
Naughty blonde babe Jana Jordan has some fun while teasing the cameraman� Jana Jordan is one of those sexy babes who knows she is hot and loves to show off her assets. Here we get to see Jana as she strips nude out of her little black dress and lick her favorite glass dildo. She lets her tits out first and lets us enjoy that hot perky set with nice round nipples
Tags: porn star. free porn video. free porn movie. porn video. gay porn. teen porn.
live porn. free porn pic. porn movie. free porn clip. lesbian porn. asian porn. cartoon porn. black porn. porn picture. amateur porn. hardcore porn. homemade porn. porn sex. free gay porn. anime porn. porn site. tube porn. free porn site. xxx porn. video porn gratis. mature porn. adult porn. free lesbian porn. porn clip. vintage porn. free teen porn. indian porn. porn dvd. free porn trailer. free black porn. porn game. celebrity porn. porn gratis
porn gallery. reality porn. free porn gallery. ebony porn. japanese porn. free porn downloads. free porn video clip. porn for pyros. porn trailer. classic porn. filme porn.
free xxx porn. interracial porn. midget porn. pink porn star. porn film. free hardcore porn . free porn vids. anal porn. home made porn.
hello my dear cialis friend.
http://personalisinglearning.info/vle/user/view.php?id=2219&course=1
Cool best site!
We shall be seen!
buy levitra online now !
buy generic cialis without credit cards
buy generic cialis without prescription
buy now cialis
buy online cialis
buy online levitra cialis viagra
buy prescription cialis
buy prescription cialis online
buy soft cialis
buy softtabs cialis
buy sublingual cialis online
buy tadalafil cialis
uy cialis without a prescription
buy generic cialis online
buy generic cialis overnight delivery
buy generic cialis softtabs
buy generic cialis softtabs cheap
buy generic cialis softtabs online
buy generic cialis uk
uy clomid without a prescription
buy generic clomid online
buy generic clomid overnight delivery
buy generic clomid softtabs
buy generic clomid softtabs cheap
buy generic clomid softtabs online
buy generic clomid uk
Click here to buy online
So, I visit your site! I like it!
Visit to