> Anyone else seen this? Just a reference to a > cross-site scripting attack, but I thought it > interesting that it was posted as a > vulnerability with the fusebox framework as > opposed to poor code implementation by the > application programmer.
It's definately an implementation issue, not a framework issue... Reminds me of something else ... I remember reading some "well respected" web developer saying that CF was crap because it didn't innately prevent XSS attacks, but then went on to promote PHP -- which also doesn't innately prevent XSS attacks. Anyway... Yeah, the folks who maintain the FB site should know better, and they should use urlencodedformat() and/or htmleditformat() on _all_ their variables... but that's not a bug in the framework... On the other hand, it is possible to have an implementation style, tool or set of tools that help to alleviate XSS attacks without necessarily requiring the developer to take the time and attention to ensure that all those variables are indeed formatted with either of those methods. The onTap framework as an example has a library of functions designed to build modular HTML interfaces. This function library is then further abstracted by a library of functions used to parse XHTML documents (or more commonly fragments) into these modular html interfaces. Either way, by using the function library or by using a parsed XHTML fragment, these tools apply the necessary html-formatting automatically (and in some cases url formatting), which virtually eliminates the threat of this form of XSS when it's used (there are of course many forms of XSS). s. isaac dealey 954.522.6080 new epoch : isn't it time for a change? add features without fixtures with the onTap open source framework http://www.fusiontap.com http://coldfusion.sys-con.com/author/4806Dealey.htm ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~| Logware (www.logware.us): a new and convenient web-based time tracking application. Start tracking and documenting hours spent on a project or with a client with Logware today. Try it for free with a 15 day trial account. http://www.houseoffusion.com/banners/view.cfm?bannerid=67 Message: http://www.houseoffusion.com/lists.cfm/link=i:4:214188 Archives: http://www.houseoffusion.com/cf_lists/threads.cfm/4 Subscription: http://www.houseoffusion.com/lists.cfm/link=s:4 Unsubscribe: http://www.houseoffusion.com/cf_lists/unsubscribe.cfm?user=11502.10531.4 Donations & Support: http://www.houseoffusion.com/tiny.cfm/54
