Differenze tra le versioni di "Template:XSS alert"

Versione delle 04:09, 22 gen 2011

WARNING: the code or configuration described here poses a major security risk.

Problem: Vulnerable to Cross-site scripting attacks, because it passes user input directly to the browser. This may lead to user accounts being hijacked, among other things.

Solution: strictly validate user input and/or apply escaping to all characters that have a special meaning in HTML.

[edit] [purge]

Template documentation

Description: Adds an alert box describing a Cross-site scripting vulnerability in including Extension page. Also adds including page to mw:Category:Extensions with XSS vulnerabilities
If your extension was tagged with this template please read

Example

{{XSS alert|~~~~}}

Creates

WARNING: the code or configuration described here poses a major security risk.

Problem: Vulnerable to Cross-site scripting attacks, because it passes user input directly to the browser. This may lead to user accounts being hijacked, among other things.
Solution: strictly validate user input and/or apply escaping to all characters that have a special meaning in HTML

Signed: Duesentrieb ⇌ 13:43, 22 March 2007 (UTC)

The above documentation is transcluded from Template:XSS alert/doc. (edit | history)
Editors can experiment in Sandbox.Please add categories and interwikis to the /doc subpage. Subpages of this template.