StackOverflow2013

Note that there are some explanatory texts on larger screens.

plurals

POHow to handle XSS on NVelocity
primarykey
Id
1413662
data
AcceptedAnswerId
1413786
AnswerCount
2
ClosedDate
CommentCount
1
CommunityOwnedDate
CreationDate
2009-09-11T23:05:09.780
FavoriteCount
1
LastActivityDate
2011-02-22T19:56:39.180
LastEditDate
2009-09-11T23:11:57.257
LastEditorUserId
71436
OwnerUserId
71436
ParentId
0
PostTypeId
1
Score
2
ViewCount
369
LastEditorDisplayName
text
Body
Castle Project is full of features, includes some awesome subprojects, and developing with it has been a pleasure. My team is almost ready to deliver a custom made <a href="http://en.wikipedia.org/wiki/Enterprise_asset_management" rel="nofollow noreferrer">EAM</a> and we are polishing our system. We tried some basic XSS attacks and guess: They all worked. Even though it will be running in a Intranet environment, we wouldn't like users to accidentally break the whole system, and we are studying solutions to handle XSS problems. NVelocity by default doesn't escape anything, so this code: <pre><code>${entity.Field} </code></pre> with Field containing things like: <pre><code><script>alert('xss!')</script> </code></pre> would give us a nice xss alert. Microsoft's AntiXSS library looks good: handles several types of possible XSS vectors, and so. We ran into AndyPike's <a href="http://dobrzanski.net/2009/01/14/nvelocity-and-xss/#comment-18974" rel="nofollow noreferrer">helper</a>, but this solution would make us refactor some couple thousand lines. Yeah, not good. And this wouldn't handle ActiveRecord/NVelocity auto bind when editing existing entities. The question is: Using output encoding techniques, is it possible/recommended to patch Castle Project's NVelocity engine? Just like they did with Brail? Anyone has a better idea? Thanks! PS.: Stackoverflowers using Castle Project would use such patch?
Tags
<xss><castle><nvelocity>
Title
How to handle XSS on NVelocity
singulars
PostAcceptedAnswerId
1. PO
 singulars
 PostTypePostTypeId
 PTAnswer
PostParentId
1. This table or related slice is empty.
PostTypePostTypeId
1. PTQuestion
UserLastEditorUserId
1. USwtaniguchi
UserOwnerUserId
1. USwtaniguchi
plurals
PostLinksPostIdRelatedPostId
1. PL
 singulars
 LinkTypeLinkTypeId
 LTLinked
PostLinksRelatedPostIdPostId
1. This table or related slice is empty.
PostsAcceptedAnswerId
1. This table or related slice is empty.
PostsParentIdCreationDate
1. PO
 singulars
 PostTypePostTypeId
 PTAnswer
2. PO
 singulars
 PostTypePostTypeId
 PTAnswer
VotesPostIdCreationDate
1. VO
 singulars
 PostPostId
 POHow to handle XSS on NVelocity
 UserUserId
 This table or related slice is empty.
 VoteTypeVoteTypeId
 VTUpMod
2. VO
 singulars
 PostPostId
 POHow to handle XSS on NVelocity
 UserUserId
 This table or related slice is empty.
 VoteTypeVoteTypeId
 VTUpMod
3. VO
 singulars
 PostPostId
 POHow to handle XSS on NVelocity
 UserUserId
 USRup
 VoteTypeVoteTypeId
 VTFavorite
CommentsPostId
1. COJust a quick note: FormHelper does HtmlEncondig before putting values into input fields.
 singulars
 PostPostId
 POHow to handle XSS on NVelocity
 UserUserId
 USwtaniguchi

Querying!

Guidance

A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.