GNU Herds - Free Software Association - Tasks: task #6679, Avoid XSS attacks
You are not allowed to post comments on this tracker with your current authentication level.
task #6679: Avoid XSS attacks
Submitter: | Davi Leal <davi> | ||
Submitted: | Sat 24 Mar 2007 10:12:13 PM UTC | ||
Should Start On: | Sat 24 Mar 2007 12:00:00 AM UTC | Should be Finished on: | Sat 24 Mar 2007 12:00:00 AM UTC |
Category: | Security | Priority: | 8 |
Status: | In Progress | Privacy: | Public |
Assigned to: | davi | Percent Complete: | 0% |
Open/Closed: | Open | Effort: | 0.00 |
Sun 08 Apr 2007 12:48:17 PM UTC, comment #1: |
Davi Leal <davi> |
Sat 24 Mar 2007 10:12:13 PM UTC, original submission:
TODO: Hard check all fields.
|
Davi Leal <davi> |
No files currently attached
Depends on the following items: None found
Items that depend on this one: None found
Carbon-Copy List
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follow 6 latest changes.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2007-08-29 | davi | Status | Postponed | In Progress | |
Privacy | Private | Public | |||
2007-07-08 | davi | Assigned to | None | davi | |
2007-07-08 | davi | Status | None | Postponed | |
2007-04-08 | davi | Assigned to | davi | None | |
2007-03-24 | davi | Summary | Avoid XSS atacks | Avoid XSS attacks |
Powered by Savane 3.13-0329.
Corresponding source code
Let me add a more detailed proposal:
Before saving to the data base the webapp must
check any feel-to-free field. So comboboxes
does not need the anti-XSS check.
1. If the field must keep an integer, we check
it keeps an integer, however
2. If the field can keep a sentence, as for example,
the description of your academic qualification,
we could just filter "<", "<", ...
This is a proposal, as usual, it is looking for improvement. Add your comment here, or just send an email to gnuherds-app-dev AT nongnu.org