Mailing-List: contact jspwiki-dev-help@incubator.apache.org; run by ezmlm
Precedence: bulk
Reply-To: jspwiki-dev@incubator.apache.org
Received-SPF: pass (nike.apache.org: local policy)
References: <15cc92000712061054j6874696cx4884b06817453ec8@mail.gmail.com>
 <4C14FAE5-6A55-40A2-861E-545B4FE542C3@ecyrd.com>
Message-Id: <7A5D4756-6E94-4C2C-9717-C1EDD29E7220@mac.com>
From: Andrew Jaquith <andrew.jaquith@mac.com>
To: "jspwiki-dev@incubator.apache.org" <jspwiki-dev@incubator.apache.org>
In-Reply-To: <4C14FAE5-6A55-40A2-861E-545B4FE542C3@ecyrd.com>
Content-Type: text/plain;
	charset=US-ASCII;
	format=flowed;
	delsp=yes
Mime-Version: 1.0 (iPhone Mail 3B48b)
Subject: Re: question on username
Content-Transfer-Encoding: 7bit
Date: Sat, 8 Dec 2007 12:08:19 -0500
Cc: "jspwiki-dev@incubator.apache.org" <jspwiki-dev@incubator.apache.org>

Yeah, the backslash is something we need to preserve. My general  
paranoid urge says that it's best to remove quotes and other special  
characters upon input to eliminate XSS. But an equally valid strategy  
is simple to make sure the *output* is properly escaped using  
TextUtil. That is probably more compatible.

Lemme check out the code and think about this a bit more...

On Dec 8, 2007, at 7:44, Janne Jalkanen <Janne.Jalkanen@ecyrd.com>  
wrote:

>
> I think it's okay to remove all the quotes, but I think some people  
> are using some weird windows names, which include a backslash.  And  
> some systems also offer brackets.
>
> So I don't really know what the allowed set of characters should  
> be.  Maybe some people are using quotes as well.
>
> /Janne
>
> On 6 Dec 2007, at 20:54, Dirk Frederickx wrote:
>
>> Ref. xss vulnerability
>>
>> Which characters are allowed in the jspwiki username ?  
>> <wiki:Username/>
>>
>>> From what I can see, there are  only checks on isBlank, all other
>> characters seem to be allowed.
>> Also the single quote, which is dangerous in the common-header.jsp,
>> where the username is inserted as javascript string.
>>
>>
>>
>> dirk
>