|
1. I can't find any reference containing XSS in the link you posted
2. This 'article' is six years old.
The best things in life are not things.
|
|
|
|
|
|
Yeah, good catch. I've 5d all 3 of your posts to make up for the other 2 responses you got 
|
|
|
|
|
Richard MacCutchan wrote: 1. I can't find any reference containing XSS in the link you posted
2. This
'article' is six years old.
The OP's referring to how the subject line renders the HTML INPUT control instead of showing the text. I am not sure this is a path to an XSS attack but it's a good idea to filter it out.
|
|
|
|
|
Nishant Sivakumar wrote: The OP's referring ...
Badly!
The best things in life are not things.
|
|
|
|
|
Richard MacCutchan wrote: Badly!
He's from Spain based on his profile and is probably not very comfortable in English. Still it was rather obvious what he was talking about. So I am kinda surprised Nagy and you could get interpret it so totally wrong.
|
|
|
|
|
you are right  , im spanish, and my english .... is very bad  
|
|
|
|
|
The original statement reads the user put input in description and appears... one input... is a XSS ... fix please
Sorry, but even accepting that OP's first language is not English I could not see what the message was trying to say. However, I guess that's just another fail on my part, so I'll move on.
The best things in life are not things.
|
|
|
|
|
Richard MacCutchan wrote: The original statement reads the user put input in description and appears...
one input... is a XSS ... fix please
Well, that's what a telegram would have looked like 50 years ago. I don't get why Nagy and you did not understand him, it seems so obvious to me. Maybe I'm just good at this stuff
|
|
|
|
|
Nishant Sivakumar wrote: Maybe I'm just good at this stuff
One point in my favor is that I am a little more used to non-native English (than most people), so maybe that helps.
|
|
|
|
|
Nishant Sivakumar wrote: I don't get why Nagy and you did not understand him, it seems so obvious to me.
OK let's break it down:
1. the user put input in description : the problem description contains the word 'input' ?
2. and appears... : and appears what ?
3. one input... : ??
4. is a XSS ... : ?? or is this part of 3, in either case I don't see what it is supposed to mean
5. fix please : that I do understand
I am still not convinced it has anything to do with the OP's use of English, more the over liberal ellipses. I spent the last 15 years of my working life supporting users across Europe, Africa, the Middle East and India, so am fairly comfortable with non-English speakers.
The best things in life are not things.
|
|
|
|
|
Richard MacCutchan wrote: 1. the user put input in description : the problem description contains the word
'input' ?
The article description contains the text "input". Maybe it's because you are not a regular author, but as someone who has written quite a few articles here, I am quite conscious of how an article has a title and a description. And considering his thread subject mentions XSS, I automatically assumed (rightly so) that input referred to the html tag.
Richard MacCutchan wrote: 2. and appears... : and appears what ?
He means that the INPUT control renders (or appears on screen). Again from (1) I already know he's talking about the INPUT-tag so I know that when he says appears, he means the control appears within the description.
Richard MacCutchan wrote: 3. one input... : ??
One INPUT-control appears (is rendered). he's re-stressing on how the control is showing up (when it shouldn't).
Richard MacCutchan wrote: 4. is a XSS ... : ?? or is this part of 3, in either case I don't see what it is
supposed to mean
What he means is that this is XSS in action here. No actual script in the example but it's trivial to add inline script to one of the control's events.
Richard MacCutchan wrote: 5. fix please : that I do understand
Wow, ok, I am surprised! 
Once again I am not saying you or Nagy were being naive here, just that I was surprised at how something that was so obvious to me was so cryptic to you guys (and I know both of you are smart people).
Maybe I am just that good.
|
|
|
|
|
Nishant Sivakumar wrote: Maybe I am just that good.
Probably true ... I know I'm not. 
The best things in life are not things.
|
|
|
|
|
i dont try, use alert('hello')</scrip> in subject but, if <input> work... I guess not check some html tags
|
|
|
|
|
soupuse that...
onfocus...
|
|
|
|
|
Yeah, there are potential risks there. Anyway Chris has fixed it, he loves fixing bugs before he had his morning coffee!
|
|
|
|
|
Thanks, fixed. I'll upload the change in a few hours.
cheers,
Chris Maunder
The Code Project | Co-founder
Microsoft C++ MVP
|
|
|
|
|
i love codeproject
|
|
|
|
|
help - advertise with us[^]
The member count is a few years old, I assume the rest of the stats are equally dated but don't have any way to check. I'd hope that the contact info for your marketing people is at least all current.
The Code Project delivers more, higher-quality viewers than any other developer-focused site. For example:
Over 5.3 million registered members
20,316,881 average page views per month*
677,229 average daily page requests*
8,657,893 visits per month*
4,073,243 unique visitors per month*
The Code Project is the only major developer-focused Web community built on high-quality, user-contributed content (over 15,800 articles so far).
3x12=36
2x12=24
1x12=12
0x12=18
|
|
|
|
|
I'm missing this[^] vote in my reputation history.
Cheers, Jani Giannoudis
|
|
|
|
|
Sometimes people write that they have voted 5, and in writing about it, convince themselves that they have already done it, and then forget to do the actual vote.
Seriously, it happens.
I think he has meant to vote, wrote about doing so, in the past tense you will note, and not realised that the vote was never cast.
Remind him.
------------------------------------
I will never again mention that I was the poster of the One Millionth Lounge Post, nor that it was complete drivel. Dalek Dave
CCC Link[ ^]
Trolls[ ^]
|
|
|
|
|
There is no vote registered by that user. I think he missed...
cheers,
Chris Maunder
The Code Project | Co-founder
Microsoft C++ MVP
|
|
|
|
|
I said that would be what it was.
------------------------------------
I will never again mention that I was the poster of the One Millionth Lounge Post, nor that it was complete drivel. Dalek Dave
CCC Link[ ^]
Trolls[ ^]
|
|
|
|
|
And you were right.
cheers,
Chris Maunder
The Code Project | Co-founder
Microsoft C++ MVP
|
|
|
|
|
Woo Hoo!
------------------------------------
I will never again mention that I was the poster of the One Millionth Lounge Post, nor that it was complete drivel. Dalek Dave
CCC Link[ ^]
Trolls[ ^]
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
