Re: logically stopping xss

[Valdis.Kletnieks () vt edu]

On Tue, 22 Jul 2003 23:55:24 EDT, KF <dotslash () snosoft com>  said:

>     SecFilter "<(.|\n)+>"

> the JavaScript language can be used on the client side, which should 
> replace the prohibited characters with special tags, e.g. &lt; &gt; 
> &quot; etc.

What's wrong with this picture? :)

The basic problem here (going all theoretical) is that there's a very messy
intermixing of executable code (javascript) and data (html) going on, forming
what's often known as a Von Neuman architecture.  If we had a Harvard
architecture (where code is code and data is data and never the twain shall
meet), we'd have a lot less trouble....

Attachment: _bin
Description: