Re: whitelisting HTML tags

[Richard Moore <rich () westpoint ltd uk>]

Thomas Chiverton wrote:
> On Wednesday 02 November 2005 15:17, you said:
>
> > Can you simply limit your input to character markup tags like
> > <b>, <i> etc?
>
>
> No.
> IE allows
> <b style="expression(alert(cookies.password))">
> type attacks, iirc.

Sure, but you don't need to support any attributes at all if
the character markup tags themselves provide sufficient flexibility.

Rich.
--
Richard Moore, Principal Software Engineer,
Westpoint Ltd,
Albion Wharf, 19 Albion Street, Manchester, M1 5LN, England
Tel: +44 161 237 1028
Fax: +44 161 237 1031