Frode Børli wrote:
Yeah, I thought about that also. Then we have more complex attributes
such as style='font-family: expression#40;a+5#41;;'... So your
sanitizer must also parse CSS properly - including unescaping
entities.
The way HTML Purifier handles this is unescaping all entities (hex
for eternity. However,
Then we need client side sandboxing.
--
Best regards / Med vennlig hilsen
Frode Børli
Seria.no
Mobile:
+47 406 16 637
Company:
+47 216 90 000
Fax:
+47 216 91 000
Think about the environment. Do not print this e-mail unless you really need to.
Tenk miljø. Ikke skriv ut
Frode Børli wrote:
td colspan='javascript(a + 5)'/td
Where a javascript returns the value in the colspan attribute. Many
server side HTML sanitizers would have to be updated - unless we
introduce a proper sandbox.
Or the HTML sanitizer could have done things properly and checked
I think we should agree on which features that WebSockets need to
provide before deciding on a protocol or method of achieving the
goals.
Basically I want these features from WebSockets:
1. The server side script that generated the page can at any later
time raise any event on the client side.
for
each item in a guestbook is a bit much. CSS syntax could be used for such a
whitelist; a[href],span[style],area[alt|href] etc. With no whitelist -
everything should be allowed, except scripts.
Frode
2008/7/23 James Ide [EMAIL PROTECTED]:
On Tue, Jul 22, 2008 at 3:22 PM, Frode Børli [EMAIL
process to be completely safe.
- James
--
Sent from Gmail for mobile | mobile.google.com
Best regards / Med vennlig hilsen
Frode Børli
Seria.no
Mobile:
+47 406 16 637
Company:
+47 216 90 000
Fax:
+47 216 91 000
Think about the environment. Do not print this e-mail unless you really need
I have some feedback based on the discussions i participated in
earlier. Since I am on vacation I cannot give a proper proposal but I
think the following should be considered:
1. Allow pure TCPSocket using this method: var s = new
TCPSocket(/tcpsocket.xml);
The tcpsocket.xml-file must have a
I like the proposal of adding a seamless attribute to the iframe element,
though it should perhaps be added using CSS since it applies to styling?
I also want the following:
span sandbox=1 /span
This is because a typical Web 2.0 usage is to have a list of comments with a
thumbs up/thumbs down
It is worth spending months improving the implementation here, if it
saves only one minute of work for each of the millions of web
developers out there, in the future.
Alright, point taken. You're of course absolutely right with that :)
I agree, it would be very convenient to basically set
Because it breaks the common interface that the value property returns a
scalar?
Doesn't renaming the .value property to for example .files also break
the common interface?
Frode
Actually, DNS servers, particularly for reverse DNS lookups, are out of the
control of a huge number of authors on the web. Shared hosting accounts for
instance don't have a unique reverse IP look up. There are also plenty of
The reverse DNS spec specifically allows one IP address to have
PROTECTED]:
On Mon, 23 Jun 2008 09:34:27 +0200, Frode Børli [EMAIL PROTECTED] wrote:
[...]
I'd suggest looking into the work the W3C has been doing on this for the
past two years:
http://dev.w3.org/2006/webapi/XMLHttpRequest-2/
http://dev.w3.org/2006/waf/access-control/
--
Anne van
?
--
Best regards / Med vennlig hilsen
Frode Børli
Seria.no
Mobile:
+47 406 16 637
Company:
+47 216 90 000
Fax:
+47 216 91 000
Think about the environment. Do not print this e-mail unless you really need to.
Tenk miljø. Ikke skriv ut denne e-posten dersom det ikke er nødvendig.
to connect.
DNS records are cached multiple places (including at the local
computer), so a DDOS attack attempting to take down DNS servers
probably not succeed.
What do you think?
Best regards,
Frode Børli
Seria AS, Norway
1. Browser downloads a script from server A.
2. Script tries to connect to server B.
3. Browser looks up server B's IP-address.
4. Browser performs a reverse lookup of server B's IP-address and gets
a host name for the server.
5. Browser looks up a special TXT record in the DNS record for
reverse DNS proposal...
--
Best regards / Med vennlig hilsen
Frode Børli
Seria.no
Mobile:
+47 406 16 637
Company:
+47 216 90 000
Fax:
+47 216 91 000
Think about the environment. Do not print this e-mail unless you really need to.
Tenk miljø. Ikke skriv ut denne e-posten dersom det ikke er
IE7 (on Vista) says the full path.
--
Thomas Broyer
--
Best regards / Med vennlig hilsen
Frode Børli
Seria.no
Mobile:
+47 406 16 637
Company:
+47 216 90 000
Fax:
+47 216 91 000
Think about the environment. Do not print this e-mail unless you really need to.
Tenk miljø. Ikke skriv ut denne e
Correct me if I am wrong: no two-way TCP daemon like telnet, ssh, POP3, NNTP
or IMAP allows reconnecting to an existing session when the connection drops
and for UDP daemons this question is moot because the connection never drops
although it can occasionally fail. Why should a custom
- as
well as sending variables/structures. Example:
var data = { name: Frode Børli, address: Norway }
document.serverConnection.send(data)
Also the client can add arbitrary event listeners to the
serverConnection object:
document.serverConnection.onwhatever = function(message) {
alert(message.city
able to use any method it likes to differentiate its services. Even URI
addressing is silly since again the application may have no concept of
paths or queries. It is simply a service running on a port. The only
valid use case for all this added complexity is proxying but nobody has
tested
this in the
specification for consistency.
Thanks,
Adele
--
Best regards / Med vennlig hilsen
Frode Børli
Seria.no
Mobile:
+47 406 16 637
Company:
+47 216 90 000
Fax:
+47 216 91 000
Think about the environment. Do not print this e-mail unless you really need to.
Tenk miljø. Ikke
attribute, which can be accessed from script as
a string.
- Adele
On Jun 19, 2008, at 2:56 PM, Frode Børli wrote:
I think it should be a select box containing each file name and
perhaps an icon, and when you select a file - it asks you if you want
to remove the file from the upload queue.
Frode
I think we should have both a pure TCPSocket, and also a ServerSocket
that keeps the same connection as the original document was downloaded
from. The ServerSocket will make it very easy for web developers to
work with, since the ServerSocket object will be available both from
the server side
without informing the user. This would allow a popular page (say a facebook
profile or banner ad) to perform massive DOS against web servers using
visitors browsers without any noticeable feedback (though I guess this is
also true of current HTTPXMLRequestObjects).
XMLHttpRequest only allows
be overloaded overloaded by
too many incoming connections.
--
Best regards / Med vennlig hilsen
Frode Børli
Seria.no
Mobile:
+47 406 16 637
Company:
+47 216 90 000
Fax:
+47 216 91 000
Think about the environment. Do not print this e-mail unless you really need to.
.
Note that this is a white list approach - which I think is far better than
the black list approach that we need to use today: style='line-height: 10px;
font-family: Arial' etc is a black list and not very maintainable.
--
Best regards / Med vennlig hilsen
Frode Børli
Seria.no
-Think about
need to escape the quotation character used (so either ' or ). The fallback
for legacy user agents would be the src= attribute.
--
Best regards / Med vennlig hilsen
Frode Børli
Seria.no
Mobile:
+47 406 16 637
Company:
+47 216 90 000
Fax:
+47 216 91 000
Think about the environment. Do
I've also been having side discussions with a few people regarding the
ability for a website owner to mark sections as data rather than code
(where everything lies now).
Your htmlarea tag idea is a good one (maybe change the tag to data
just a nitpick) however you don't address the use case
makes having the secure
channel pointless.
3. It is extremely dangerous to assume that nobody in the future will
ever need to have secure communications with user generated content.
Best regards, Frode Børli - Seria.no
I have been reading up on past discussions on sandboxing content, and
I feel that it is generally agreed on that there should be some
mechanism for marking content as user generated. The discussion
mainly appears to be focused on implementation. Please read my
implementation notes at the end
is in place if unescaped content is found after the
textarea start tag also?
--
Best regards / Med vennlig hilsen
Frode Børli
Seria.no
Mobile:
+47 406 16 637
Company:
+47 216 90 000
Fax:
+47 216 91 000
Think about the environment. Do not print this e-mail unless you really need
to.
Tenk miljø. Ikke
is in place if unescaped content is found after the
textarea start tag also?
--
Best regards / Med vennlig hilsen
Frode Børli
Seria.no
Mobile:
+47 406 16 637
Company:
+47 216 90 000
Fax:
+47 216 91 000
Think about the environment. Do not print this e-mail unless you really need
to.
Tenk miljø. Ikke
32 matches
Mail list logo
