Return-Path: Delivered-To: apmail-lucene-solr-commits-archive@minotaur.apache.org Received: (qmail 69472 invoked from network); 18 Nov 2010 14:24:09 -0000 Received: from unknown (HELO mail.apache.org) (140.211.11.3) by 140.211.11.9 with SMTP; 18 Nov 2010 14:24:09 -0000 Received: (qmail 10993 invoked by uid 500); 18 Nov 2010 14:24:41 -0000 Delivered-To: apmail-lucene-solr-commits-archive@lucene.apache.org Received: (qmail 10684 invoked by uid 500); 18 Nov 2010 14:24:39 -0000 Mailing-List: contact solr-commits-help@lucene.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: solr-dev@lucene.apache.org Delivered-To: mailing list solr-commits@lucene.apache.org Received: (qmail 10675 invoked by uid 99); 18 Nov 2010 14:24:39 -0000 Received: from nike.apache.org (HELO nike.apache.org) (192.87.106.230) by apache.org (qpsmtpd/0.29) with ESMTP; Thu, 18 Nov 2010 14:24:39 +0000 X-ASF-Spam-Status: No, hits=-2000.0 required=10.0 tests=ALL_TRUSTED X-Spam-Check-By: apache.org Received: from [140.211.11.131] (HELO eos.apache.org) (140.211.11.131) by apache.org (qpsmtpd/0.29) with ESMTP; Thu, 18 Nov 2010 14:24:36 +0000 Received: from eosnew.apache.org (localhost [127.0.0.1]) by eos.apache.org (Postfix) with ESMTP id 6A0C421C for ; Thu, 18 Nov 2010 14:23:59 +0000 (UTC) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable From: Apache Wiki To: Apache Wiki Date: Thu, 18 Nov 2010 14:23:59 -0000 Message-ID: <20101118142359.63702.48697@eosnew.apache.org> Subject: =?utf-8?q?=5BSolr_Wiki=5D_Update_of_=22SolrSecurity=22_by_TomGullo?= X-Virus-Checked: Checked by ClamAV on apache.org Dear Wiki user, You have subscribed to a wiki page or wiki category on "Solr Wiki" for chan= ge notification. The "SolrSecurity" page has been changed by TomGullo. http://wiki.apache.org/solr/SolrSecurity?action=3Ddiff&rev1=3D17&rev2=3D18 -------------------------------------------------- =3D=3D Cross-Site Scripting (XSS) =3D=3D = Solr has no known [[http://en.wikipedia.org/wiki/Cross-site_scripting|cro= ss-site scripting vulnerabilities]]. + = + Quick XSS tip: = What if you want the browser to indicate highlighted text, but you also w= ant to protect yourself from XSS and escape the HTML output. One way to to= is to escape the HTML output and then reapply the em tags for highlightin= g. = =20