Re: Feedback: WW-2414, XSS attack is possible if using and

[Antonio Petrelli]

2008/1/15, GF <[EMAIL PROTECTED]>:
> >
> > Or better, escape them with their corresponding entity.
>
> What do you think about
>
> <s:a href="%{myVar}" doubleQuoteEncoding="none | urlEncode |
> htmlEncode | convertToSingleQuote >...</s:a>

It could be a solution, but:
<a href="javascript:alert(&quot;bye&quot;)">Greet</a>
simply works.

Antonio

---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]