Re: Suggestion on how to eliminate Cross-site-scripting (XSS) bugs for good.
Shlomi Fish <[email protected]>
| Newsgroups | gmane.comp.lang.perl.modules.html-template |
|---|---|
| Message-ID | <[email protected]> |
On Tuesday 17 October 2006 14:08, Alex Kapranoff wrote: > * Shlomi Fish <[email protected]> [October 17 2006, 14:23]: > > Now what I want is to sub-class HTML::Template so we'll always have to > > use "ESCAPE=HTML". If we want to override it we'll need to do the > > following: > > There's `default_escape' option in recent HTML::Template. Is it not > enough? Having read the thread, I don't think that's enough for me. I want to still need to explicitly specify "ESCAPE=HTML" everywhere (without having a default escape), to have an exception raised on a non-escaped occurence, and to add an explicit unescaping (like "ESCAPE="0""). Anything less than that will make the transition to the new code harder, and more error-prone. So I guess I'm going to fire up my editor and write an HTML::Template sub-class. Regards, Shlomi Fish --------------------------------------------------------------------- Shlomi Fish [email protected] Homepage: http://www.shlomifish.org/ Chuck Norris wrote a complete Perl 6 implementation in a day but then destroyed all evidence with his bare hands, so no one will know his secrets. ------------------------------------------------------------------------- Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642