259fd19c1b
- Now using Spring Boot for classloading, this way local development does not need to restart the complete server - Fixed all kinds of dependencies on the names of the lessons necessary to keep in mind during the creation of a lesson. - Simplied loading of resources, by adding resource mappings in MvcConfig. - Refactored plugin loading, now only one class is left for loading the lessons.
21 lines
345 B
Plaintext
21 lines
345 B
Plaintext
== DOM-based XSS Defense
|
||
|
||
* Attacker creates url:
|
||
+
|
||
----
|
||
http://mylogin.com/login?error=<script>alert(“xss”)</script>
|
||
----
|
||
|
||
* JavaScript must enforce input validation
|
||
+
|
||
----
|
||
if ( errorMsg\[1\].match(/^[ a-zA-Z0-9:-]$/))
|
||
{
|
||
document.write(‘some error’);
|
||
}
|
||
else
|
||
{
|
||
document.write('<b>'+errorMsg\[1\]+'</b>');
|
||
}
|
||
----
|