Re: Partial validation results from an invalid input?
Chris Lambacher <[email protected]> Mon, 26 Dec 2011 19:37:08 -0500
| Newsgroups | gmane.comp.python.formencode |
|---|---|
| Message-ID | <CAAXXHgJfdiBzapYQ8U+g4Z5=b+QVZ8OwzOdLwMom1sg-3CkCqg@mail.gmail.com> |
On Mon, Dec 26, 2011 at 6:11 PM, W-Mark Kubacki <wmark-/[email protected]> wrote: > 2011/12/27 Chris Lambacher <[email protected]>: >> >> Use the raw post values to render the page. You shouldn't need >> validated values to do so.[...] > > Of course Chris wanted to be brief in his answer; just one thing we > sometimes forget to mention: > > *Don't* use unvalidated/unfiltered values for re-rendering your form! > Imagine someone provided a value such as: > "><script language="">... > It will open your webapp to XSS, (XSRF, too?) or other kinds of attacks. Mark is of course correct. I sometimes forget that not all template languages automatically escape values inserted into templates. If you are going to be re-inserting unvalidated post values into your templates make sure that your template language (or form rendering tool) properly escapes values inserted into the page. -Chris -- Christopher Lambacher [email protected] ------------------------------------------------------------------------------ Write once. Port to many. Get the SDK and tools to simplify cross-platform app development. Create new or port existing apps to sell to consumers worldwide. Explore the Intel AppUpSM program developer opportunity. appdeveloper.intel.com/join http://p.sf.net/sfu/intel-appdev