>Matthew wrote: >The potential failure here is that Zend_View probably should be escaping variables by >default, and this is an improvement slated for 2.0.0.
Is this for all fields that are sent to a view? Are we talking about something like: $this->view->myvar = "blah"; And that being automatically escaped ? What happens if I pass pre-HTML-escaped value to the view, do I get those annoying extra \\ in there? What if I pass a pre-processed html or another view? Ajax for example. However, I could be confused on what is going to be escaped. -----Original Message----- From: Matthew Weier O'Phinney [mailto:[EMAIL PROTECTED] Sent: Wednesday, July 30, 2008 1:50 PM To: [email protected] Subject: Re: [fw-general] Cross site scripting inZend_Db_Statement_Exception handling -- Bill Karwin <[EMAIL PROTECTED]> wrote (on Wednesday, 30 July 2008, 10:14 AM -0700): > Matthew Weier O'Phinney-3 wrote: > > > > However, you're right -- the value should be escaped. I'll escalate > > the issue. > > > > Really? Message strings in Exceptions should be HTML-escaped? > > If this constitutes an XSS vulnerability, then one could equally argue > that PHP should automatically escape any error or exception output if > it is being directed to the page. Though it's hard for PHP to know > when to do this, because of other conditions, e.g. output buffering > may be in effect, and PHP doesn't know whether you plan to escape the contents of the ob. > > My point is that escaping output is the responsibility of the > application, not the framework (or the language). Only the > application developer knows when it's the right thing to do. When I discovered that the original string is generated by PDO, I came to the same conclusion. This is not a failure on ZF's part, but a failure on the developer to (a) prevent exceptions showing in their output, and (b) not escaping the output when they did allow exceptions to be shown. The potential failure here is that Zend_View probably should be escaping variables by default, and this is an improvement slated for 2.0.0. -- Matthew Weier O'Phinney Software Architect | [EMAIL PROTECTED] Zend Framework | http://framework.zend.com/
