Tuesday June 13, 2006 The main method of preventing Cross Site Scripting (XSS)
is through
entity encoding, using entities
such as "<".
We now have a introduced a native input
stage filter based
on
sed which can do XSS filtering. This
For example, if we take example of request body posted in HTML form containing
sed-request filter
applies sed edit commands to an incoming request entity
body, e.g. an uploaded file or submitted form.
Input fn="insert-filter" ... filter="sed-request" sed="script" [
sed="script" ... ]For example, if we take example of request body posted in HTML form containing
"<"
and ">" characters. In ModSecurity you have SecFilter
like
SecFilterEngine On |
