News for hackers. Stuff that matters.

A comment on Userdir URLs like https://example.org/~username/ are dangerous. Parent comment

Re:Userdir URLs like https://example.org/~username/ are dang... by LunaSea on Wednesday April 08, 2020 @04:20AM (#22811025)
This is demonstrably false.

HTML is based on XML and even if you remove JavaScript, you could still create XML tags and attributes that lead to malicious behaviour and information leaks.

Want to guess which vulnerability jumped from not being in the OWASP top 10 to being in the 4th place? XML External Entities (XXE).

[ Parent | on HN ]
Re:Userdir URLs like https://example.org/~username/ are dang... by hhas01 on Wednesday April 08, 2020 @06:10AM (#22811590)
HTML is based on SGML. XML is a subset of SGML. XHTML is HTML converted to valid XML. IANAE, but I suspect most problems originate with SGML, which was designed for flexibility and extensibility rather than security. That’s compounded by the sprawling complexities of both HTML and XML that easily masks weaknesses and holes and makes implementation very hard to verify. Road to Hell, etc.
[ Parent | on HN ]