- From: poot <cvsmail@w3.org>
- Date: Tue, 02 Aug 2011 18:00:46 -0400
- To: public-html-diffs@w3.org
hixie: Recommend against blacklists. (whatwg r6347)
http://dev.w3.org/cvsweb/html5/spec/Overview.html?r1=1.5069&r2=1.5070&f=h
http://html5.org/tools/web-apps-tracker?from=6346&to=6347
===================================================================
RCS file: /sources/public/html5/spec/Overview.html,v
retrieving revision 1.5069
retrieving revision 1.5070
diff -u -d -r1.5069 -r1.5070
--- Overview.html 2 Aug 2011 21:47:33 -0000 1.5069
+++ Overview.html 2 Aug 2011 22:00:33 -0000 1.5070
@@ -1718,6 +1718,13 @@
process, to the catastrophic, such as deleting all data in the
server.</p>
+ <p>When writing filters to validate user input, it is imperative
+ that filters always be whitelist-based, allowing known-safe
+ constructs and disallowing all other input. Blacklist-based
+ filters that disallow known-bad inputs and allow everything else
+ are not secure, as not everything that is bad is yet known (for
+ example, because it might be invented in the future).</p>
+
<div class="example">
<p>For example, suppose a page looked at its URL's query string
Received on Tuesday, 2 August 2011 22:00:52 UTC