JavaScript needs to be disabled in parameters. http://www.wikipedia.org/wiki/JavaScript_table_security_hole Try to click on the link to Main Page. The JS there is harmless but there are so many possible things one can do with it.... For that matter, parameters need to be checked for sanity. If you look at the wikisource and the HTML source of that page, the table has the meaningless attributes "foo 15". Not foo=15, foo and 15 separately. A check needs to be made for approved attributes, just like the check for approved HTML tags. ===== -Geoffrey Thomas geoffreyerffoeg(a)yahoo.com __________________________________ Do you Yahoo!? Yahoo! SiteBuilder - Free, easy-to-use web site design software http://sitebuilder.yahoo.com

--- Brion Vibber <brion(a)pobox.com> wrote: Ah, sorry. Forgot to click save. ;-) Server was a bit slow so I got distracted.... ===== __________________________________ Do you Yahoo!? Yahoo! SiteBuilder - Free, easy-to-use web site design software http://sitebuilder.yahoo.com

On Tue, 2003-09-16 at 14:48, Geoffrey Thomas wrote: Oh, in Magnus's magic table code. Sigh... {| onMouseOver="alert('hey');" foo 15 |[[Main Page]] |} I'm deleting the page. -- brion vibber (brion @ pobox.com)

Instead of stripping JavaScript from the input, why not strip it from the output (of the body, not the whole page)? That would solve this problem and anything similar. On Tue, 2003-09-16 at 23:02, Brion Vibber wrote: -- Chris Seaton <chris(a)chrisseaton.com>

Brion Vibber wrote: I can't resist: legitimate javascript? Isn't that an oxymoron? ;) Carry on. -- Jake

On Wed, 2003-09-17 at 00:41, Magnus Manske wrote: In general it's safer to only allow known safe things than to allow anything but known unsafe things. If a new unsafe attribute or tag comes into existence, you're not protected against it. Ahhh, code reuse. :) -- brion vibber (brion @ pobox.com)