In the website I'm developing, I'm giving users a 500px by 500px section that they can add html to in their profile. Currently, I am stripping script, iframe, and link tags and likewise am not allowing an uneven amount of opening and closing tags (that way people don't try to had a </div> in order to break the styling.
The reason I'm allowing HTML is so that people have a lot of freedom to style this section (such as creating a background image, floating things, etc.
What other hacks might people potentially try to abuse?
One thing I've thought about is trying to position elements outside of the 500px by 500px box in order to cover up other parts of the page. Any idea how I can stop this from happening?
<plaintext>
No but seriously, allowing HTML usage is a serious security flaw. It's better to whitelist tags than to blacklist potentially unsafe ones.
None.
whitelists are always and will always be inherently more secure than blacklists.
"Parliamentary inquiry, Mr. Chairman - do we have to call the Gentleman a gentleman if he's not one?"
Be sure to whitelist attributes, too.
Edit:
Obligatory.
Post has been edited 1 time(s), last time on Jan 9 2011, 6:36 am by Tuxedo-Templar.
None.
Strip IE-only CSS expressions from your code, too.
<span style="display:expression( alert('I can rape your shit with this!') || 'inline')">O HAI</span>
None.
Sanitizing CSS opens up its own can of worms. Clickjacking, anyone?
None.
Quote from name:Tuxedo-Templar
Sanitizing CSS opens up its own can of worms. Clickjacking, anyone?
Can't be overly difficult to simply parse out expression() values. Not that anyone using IE deserves a secure browsing experience, but still.
None.
Ultraviolet -- I suppose we'll likely never know, but my guess would be that they already saw it operating successfully and there was no monetary incentive to finish the original work. And the dev cycle in old school Blizzard was so hectic, it's possible it just got forgotten about after the original game got released. Plus there's an element of existing MPQ files that were packaged with the original discs becoming outdated if they updated it. And it's not like they remade the original MPQs, they just made new ones for BW specifically
NudeRaider -- to clarify: couldn't recall the behavior for every single Protoss building but I was aware the disparity exists.
