Need to strip/disable script

[Guest]

Hello all,

My users can include html with their data, in order to control formatting,
images, etc. in the datagrid I return, but I want to make sure in certain
cases they can't enter script. When I find it I will replace with something
harmless, but I want to make sure I find it.

So, far I am trapping for:
- <script>
- onxxx=

Are there other ways they can inject script?

Also, are there other dangerous things they can do without using script?
(outside of the basics like SQL injection, DOS, etc.).

Thanks,

Bill

 

[ajamrozek]

Are you just checking for <script> or <script
i would check for the latter

 

[Guest]

Yes, I'm checking for the latter, thanks.

Also, at least at IE6, the browser correctly ignores any leading spaces
between the "<" and the "script", but I'm on the lookout for this type of
syntactical loophole and other ways to sneak script in there. Any other
thoughts are appreciated.

 

[recoil]

There are numerous ways that one can slip it in. css style expressions
which Microsoft browsers support and events are 2 ways. There have also
been various xml/databinding related syntaxes that have been able to
provide attacks. I would try to see if you could simplify your
formatting somehow

 

[Guest]

I would html encode everything that is not on a white list. This way you are
sure that only approved html can be entered. Also if a new executable tag or
something like it is added you will already be blocking it.