canmove, Confirmed users, Bureaucrats and Sysops emeriti
2,776
edits
Security/Features/XSS Filter: Difference between revisions
no edit summary
No edit summary |
No edit summary |
||
| Line 38: | Line 38: | ||
|Feature security health=OK | |Feature security health=OK | ||
|Feature security notes=Needs a 2nd review meeting | |Feature security notes=Needs a 2nd review meeting | ||
* [[ | * [[Security/Reviews/xssfilter|Notes]] | ||
}} | }} | ||
*IE8 filter: based on regexps, it is basically a proxy (even though it lives in the browser process) that mangles scripts if they are deemed malicious. Sanitizing the attack through mangling is very dangerous, because it might affect the way the rest of the page is parsed. This made an attack possible on an earlier version of the filter. | *IE8 filter: based on regexps, it is basically a proxy (even though it lives in the browser process) that mangles scripts if they are deemed malicious. Sanitizing the attack through mangling is very dangerous, because it might affect the way the rest of the page is parsed. This made an attack possible on an earlier version of the filter. | ||