Comments on Google Online Security Blog: Reducing XSS by way of Automatic Context-Aware Esc...

IF you want to help remove malware then go here.. ...

2009-05-09T23:53:00.000-07:00

IF you want to help remove malware then go here..

http://remove-malware.com/

Its here the quality work clean of little else is ...

2009-04-21T18:29:00.000-07:00

Its here the quality work clean of little else is done at Google. Very good blog post.

Escape-sequences cause so much problem and have do it so long. People patching code from different generations, different projekt and so on.

Very usefull.

It seems that the inferred filter may be less spec...

2009-04-20T18:19:00.000-07:00

It seems that the inferred filter may be less specific than the actual syntax for the value to be substituted. For instance, the CSS example expects a colour, but the inferred filter will only reject specific unsafe CSS constructs, by the sound of it.

Other than reading the source code, is there any documentation on precisely what each escaping filter does?

Please roll these changes into the version of clea...

2009-04-19T11:58:00.000-07:00

Please roll these changes into the version of clearsilver that is available on appengine:

http://code.google.com/p/googleappengine/issues/detail?id=1363

Hi So you consider that on large applications, th...

2009-04-14T03:54:00.000-07:00

Hi

So you consider that on large applications, the approach of filtering data when it enters the program is not maintainable. Some dev will forget it, and there is no way to test if all the necessary filters are in place, so you put a big bold filter on the output.

It seems efficient at cleaning the output from xss attacks style, but
isn't the remedy worst that the disease ?

If, when it was really necessary devs were forgetting to properly filters inputs, now that there is that filter-on-output system, won't they be even more lazy ?

It seems to me that this approach hardens protection against xss-attacks, and weaken protection against more old school attacks.

olivvv

Hello. Auto-Escaping and Context-Aware Escaping ar...

2009-04-07T09:46:00.000-07:00

Hello. Auto-Escaping and Context-Aware Escaping are great concepts. They can be used by PHP programmers too - they are implemented in Nette Framework (see http://jdem.cz/a96g5 )

You guys are a little over my head, but you guys a...

2009-04-05T20:37:00.000-07:00

You guys are a little over my head, but you guys are awesome. Thanks for all the info!
Jack O'Sullivan
Bedroom Sets

For some additional background on context sensitiv...

2009-04-02T13:32:00.000-07:00

For some additional background on context sensitive escaping in HTML, check out OWASP's XSS Prevention Cheat Sheet at http://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet. Are there differences with what is recommended there?

I like django solution - all data substitution are...

2009-04-01T04:49:00.000-07:00

I like django solution - all data substitution are dangerouse, but when you need html you place 'safe' filter, and now you start really thinking safe it or not