NOTE: use Perl; is on undef hiatus. You can read content, but you can't post it. More info will be forthcoming forthcomingly.
All the Perl that's Practical to Extract and Report
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
In the near future, the probability is close to zero. In the distant
future, I'll be dead, and posterity can do whatever they like... :-) --lwall
Stories, comments, journals, and other submissions on use Perl; are Copyright 1998-2006, their respective owners.
I hate to be pessimistic but ... (Score:1)
Ilya Martynov (http://martynov.org/ [martynov.org])
Re:I hate to be pessimistic but ... (Score:2)
Re:I hate to be pessimistic but ... (Score:1)
Ilya Martynov (http://martynov.org/ [martynov.org])
Reply to This
Parent
Re:I hate to be pessimistic but ... (Score:2)
Mind explaining how this works? I still don't know enough about XSS, but it's a technique that has fascinated me ever since I watched Jeffrey Baker demo it at the Open Source Conference 2.5 years ago.
Re:I hate to be pessimistic but ... (Score:1)
Attacker can pass as value of "cookie" parameter something like "\n\n<javascript>....</javascript>" so this CGI ends up printing:
See? Since arbitrar
Ilya Martynov (http://martynov.org/ [martynov.org])
Re:I hate to be pessimistic but ... (Score:2)
$r->headers_out->add()or the Cookie taglib (which uses headers_out underneath). Creating cookies with the cookie taglib automatically encodes and decodes them.Re:I hate to be pessimistic but ... (Score:2)
Most interesting.