Re: [mod-security-users] about Data encoding

[Ivan R. <iva...@gm...>]

Yes - htmlEntityDecode.

On 6/26/06, j liu <no...@gm...> wrote:
>
> 09 (horizontal tab), 10 (newline) and 13 (carriage return)
>
> <IMG SRC="jav&#x09;ascript:alert('XSS');">
> <IMG SRC="jav&#x0A;ascript:alert('XSS');">
> <IMG SRC="jav&#x0D;ascript:alert('XSS');">
> these three can work in xss attack
> do you provide the remove function?
> thanks!

-- 
Ivan Ristic, Technical Director
Thinking Stone, http://www.thinkingstone.com
ModSecurity: Open source Web Application Firewall