Re:Persistent XSS on Twitter.com
by jluxenberg on Thursday June 24, 2010 @01:31PM
(#1458561)
"appears to be due to a lack of input validation of the application name field"
They should just be sure that they _render_ the application name field appropriately. Angle brackets should be escaped, minimally. It's really not so difficult, Ruby does it with three calls to gsub:
http://rdoc.sourceforge.net/rd/doc/classes/CGI.src/M000003.h...
They should just be sure that they _render_ the application name field appropriately. Angle brackets should be escaped, minimally. It's really not so difficult, Ruby does it with three calls to gsub: http://rdoc.sourceforge.net/rd/doc/classes/CGI.src/M000003.h...