On Wed, Jul 30, 2008 at 6:14 PM, Bill Karwin <[EMAIL PROTECTED]> wrote:
> > > > Matthew Weier O'Phinney-3 wrote: > > > > However, you're right -- the value should be escaped. I'll escalate the > > issue. > > > > Really? Message strings in Exceptions should be HTML-escaped? Yeah this would be a pain, it would cause some strange issues for CLI scripts that want to output errors to stderr they would all be html escaped. Surely it is down the the developer to catch the error and echo it out with what ever filtering they need. e.g. in a view script <?=$this->escape($e->getMessage());?> > > If this constitutes an XSS vulnerability, then one could equally argue that > PHP should automatically escape any error or exception output if it is > being > directed to the page. Though it's hard for PHP to know when to do this, > because of other conditions, e.g. output buffering may be in effect, and > PHP > doesn't know whether you plan to escape the contents of the ob. > > My point is that escaping output is the responsibility of the application, > not the framework (or the language). Only the application developer knows > when it's the right thing to do. > > Regards, > Bill Karwin > -- > View this message in context: > http://www.nabble.com/Cross-site-scripting-in-Zend_Db_Statement_Exception-handling-tp18716897p18738104.html > Sent from the Zend Framework mailing list archive at Nabble.com. > > Regards /James
