--On mercredi 23 janvier 2002 17:12 +0000 Leon Brocard <[EMAIL PROTECTED]> wrote:
> Vladimir Pastukhov sent the following bits through the ether: > >> Andy, I think it's not a good idea to encode high character codes >> by default since there are languages that do not use latin-1 entities. >> There should be a new separate filter or a global configuration option >> or something, otherwise many people would have to change existing >> templates to achieve original behavior. > > However, this does need to be done for Latin-1 entities to prevent > cross site scripting exploits (something HTML::Entities does but > Apache::Utils does not, according to a recent thread on the mod_perl > list). Hmmm. Is this true if the correct charset is output, e.g. Content-Type: text/html; charset=iso-8859-1 In this case I believe accented characters do not need to be converted into entities. If they are then it would significantly increase the number of bytes being sent to the clients. If I understand http://httpd.apache.org/info/css-security/apache_specific.html correctly specifying an explicit charset (or using AddDefaultCharset) defeats cross-site scripting issues. -- Eric Cholet
