Re: Suggestion on how to eliminate Cross-site-scripting (XSS) bugs for good.
Tom Heady <[email protected]>
| Newsgroups | gmane.comp.lang.perl.modules.html-template |
|---|---|
| Message-ID | <[email protected]> |
Alex Kapranoff wrote: > * Michael Peters <[email protected]> [October 17 2006, 17:01]: >> Alex Kapranoff wrote: >>> * Shlomi Fish <[email protected]> [October 17 2006, 14:23]: >>>> Now what I want is to sub-class HTML::Template so we'll always have to >>>> use "ESCAPE=HTML". If we want to override it we'll need to do the following: >>> There's `default_escape' option in recent HTML::Template. Is it not >>> enough? >> I think if you use default_escape => 'HTML' that would get him most of the way. >> But there should be a way to turn off escaping when you know the var will >> contain HTML. So maybe an escape="none" option? > > ESCAPE="0" works for now. > Actually, I found that turning off escaping (ESCAPE="0") does not work if you specify a default escape. See http://rt.cpan.org/Public/Bug/Display.html?id=18274 for more details and a fix. ---Tom ------------------------------------------------------------------------- Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642