HTML5 Security Cheatsheet: What your browser does when you look away...
1–10 of 15 posts
Re: HTML5 Security Cheatsheet: What your browser does when you look away...
#2Some of these are ingenius. Placing an input box far down a page, setting it to autofocus, and then reacting to body onscroll? I'd never have thought of that. Glad these references exist!
I have exploited the embedding of Flash to do XSS before. It's funny that while the site I was on heavily filtered any JS input in its rich text editor, you could easily upload a Flash file (served from the SAME domain!), and XSS it.
Re: HTML5 Security Cheatsheet: What your browser does when you look away...
#3I don't get it. This page basically shows all available event handlers and other attributes for HTML elements and says "you can put JavaScript here". Well, thanks.
Letting your users write HTML/CSS (or not escaping input) is a bad idea to begin with.
Re: HTML5 Security Cheatsheet: What your browser does when you look away...
#4I don't get it. This page basically shows all available event handlers and other attributes for HTML elements and says "you can put JavaScript here". Well, thanks. Letting your users write HTML/CSS (or not escaping input) is a bad idea to begin with.
Sometimes you have to allow some user input, like , , or tags in those WYSIWYG editors. This is a reference for what you should remove from your whitelist or add to your blacklist.
Re: HTML5 Security Cheatsheet: What your browser does when you look away...
#5I don't get it. This page basically shows all available event handlers and other attributes for HTML elements and says "you can put JavaScript here". Well, thanks. Letting your users write HTML/CSS (or not escaping input) is a bad idea to begin with.
Sometimes you have to allow some user input, like , , or tags in those WYSIWYG editors. This is a reference for what you should remove from your whitelist or add to your blacklist.
Still, OP's right. If you need to let them use plain HTML (it's better to use markdown or something similar) just parse it and remove any attributes and tags not on your whitelist.
Re: HTML5 Security Cheatsheet: What your browser does when you look away...
#6I don't get it. This page basically shows all available event handlers and other attributes for HTML elements and says "you can put JavaScript here". Well, thanks. Letting your users write HTML/CSS (or not escaping input) is a bad idea to begin with.
Sometimes you have to allow some user input, like , , or tags in those WYSIWYG editors. This is a reference for what you should remove from your whitelist or add to your blacklist.
I can't believe anyone has attributes like "onfocus" on their whitelist.
Although I respect the site's aim for completeness, the whole site could be shortened to one example of each issue. One example of "on..." attributes, one example of "javascript:" URLs, and so on. I don't see the value of the second, third, yet-another "on..." example. This is just hiding the deeper issues in a mess of seemingly clever examples.
Regarding the blacklist proposal, I really hope that nobody is seriously using those for HTML! One typo, one forgotten entry, or one new browser feature, and the blacklist's security drops to zero.
Re: HTML5 Security Cheatsheet: What your browser does when you look away...
#7This page could be much better with just a little bit more prose.
Re: HTML5 Security Cheatsheet: What your browser does when you look away...
#8Some of these are ingenius. Placing an input box far down a page, setting it to autofocus, and then reacting to body onscroll? I'd never have thought of that. Glad these references exist! I have exploited the embedding of Flash to do XSS before. It's funny that while the site I was on heavily filtered any JS input in its rich text editor, you could easily upload a Flash file (served from the SAME domain!), and XSS it…
> Some of these are ingenius. Placing an input box far down a page, setting it to autofocus, and then reacting to body onscroll?
Although this sounds quite clever, I don't see the value in this. If your HTML whitelist contains "on..." attributes such as "onscroll", you have deeper issues than this clever trick. Almost certainly you are vulnerable to stuff like "onclick", too.
Except if you use blacklists where you added "onclick" and forgot to add "onscroll". But in that case, if you are using blacklists instead of whitelists, you are almost certainly doomed anyway. (see https://news.ycombinator.com/item?id=4794745)
Re: HTML5 Security Cheatsheet: What your browser does when you look away...
#9Earlier quoted context omitted.
Sometimes you have to allow some user input, like , , or tags in those WYSIWYG editors. This is a reference for what you should remove from your whitelist or add to your blacklist.
Still, OP's right. If you need to let them use plain HTML (it's better to use markdown or something similar) just parse it and remove any attributes and tags not on your whitelist.
Or make them use Markdown, org-mode syntax, BBCode or s-expressions ({b text in bold {i and italics}}). User formatting should never go directly to the browser, without being reinterpreted by the website.
Re: HTML5 Security Cheatsheet: What your browser does when you look away...
#10Quite a list. Kinda makes me feel bad for all the people writing HTML sanitizers :(