bugtraq - Re: IndonesiaHack Advisory HTML injection in PHP Fusebox

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20060123224143.29962.qmail@securityfocus.com>
Date: 23 Jan 2006 22:41:43 -0000
From: brian428@...oo.com
To: bugtraq@...urityfocus.com
Subject: Re: IndonesiaHack Advisory HTML injection in PHP Fusebox

This isn't a vulnerability. The framework is doing what it is supposed to, and it isn't the job of the framework to place arbitrary restrictions on what the user can pass into it. For example, the CF version of Fusebox has also had this "vulnerability" pointed out. But CF already has a mechanism to eliminate XSS attacks through the use of the "scriptProtect" attribute of the cfapplication tag. So if the core file were to incorporate some sort of XSS scrubbing, it would have to be disabled by default so as not to duplicate what the web application server is already doing. Which would mean the developer would have to turn it on. Which would mean that the developer already was aware of the danger of XSS and the need to prevent it. Which would make the addition of framework-based scrubbing moot. The framework is there to ease development, not stop the developer from making every kind of mistake.