[owasp-intrinsic-security] Fwd: Defending XSSAttachs-by Browsers

Arshan Dabirsiaghi arshan.dabirsiaghi at aspectsecurity.com
Tue Sep 2 11:04:10 EDT 2008


Agree with you on mostly everything here. Just two things:
 
> Anti-Samy is great, but it again flies in the face of completely open HTML.
 
Can you elaborate? You can paste any kind of code into AntiSamy - dirty, broken fragmented HTML or clean code generated from a WYSIWYG.
 
> As I said, this is not a suggestion we as a group need to make.  It's already well understood by both FF and
> IE and has been since I first started talking about it with them 3-4 years ago. 
 
Even if they are aware of it, I think we should still recommend it (and the jail). This group is as much about implementing real life solutions to webappsec problems as it is drawing a line in the sand in a non-confrontational way. There is value in saying "Today, September 1st, OWASP is telling the world as a publicly recognized authority, these are the security technologies that will help protect consumers."
 
Cheers,
Arshan

 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: https://lists.owasp.org/pipermail/owasp-intrinsic-security/attachments/20080902/b0d2e0d3/attachment.html 


More information about the owasp-intrinsic-security mailing list