[owasp-intrinsic-security] Fwd: Defending XSSAttachs-by Browsers
arshan.dabirsiaghi at aspectsecurity.com
Tue Sep 2 11:04:10 EDT 2008
Agree with you on mostly everything here. Just two things:
> Anti-Samy is great, but it again flies in the face of completely open HTML.
Can you elaborate? You can paste any kind of code into AntiSamy - dirty, broken fragmented HTML or clean code generated from a WYSIWYG.
> As I said, this is not a suggestion we as a group need to make. It's already well understood by both FF and
> IE and has been since I first started talking about it with them 3-4 years ago.
Even if they are aware of it, I think we should still recommend it (and the jail). This group is as much about implementing real life solutions to webappsec problems as it is drawing a line in the sand in a non-confrontational way. There is value in saying "Today, September 1st, OWASP is telling the world as a publicly recognized authority, these are the security technologies that will help protect consumers."
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the owasp-intrinsic-security