This is a common type comment made in one of our cost type applications. Unless the field is HTML, the < conversion won't work - it will take the literal '<' and display.

Add the dual complexity of storing data and then in a view or elsewhere hyperlinking part of that data for a clickable URL to open it or whatever. I would love to hear what the latest goings on are for this.

Did u worked on how we can fix the XSS for domino ,if so can u please share the database to me

@trivenigk@gmail.com

thanks

Triveni

I urgently need a xss filter in java library format for one of my projects. What do you recommend?

In addition, is there any non-opensource type of xss filter which I can subscribe for service support?

Thanks in advance.

As you can see it's been some time since I have been back to your site. Please send me an email if you can and let me know what resources you have avail. for XSS. We have tried several things over the months including add-on software to no avail.

Thanks.

We recently did an appscan as part of the security process at work and found a number of cross site scripting issues with our apps. Has anyone developed a strategy to reolve this issue within domino???

Java agent or some type of coding method that does not require input validation on every field....

Thanks,

Colin

Public Function HTMLEncodeXSS(dirtyString As String) As String

Dim cleanString As Variant

Dim vOriginal(0) As String

Dim vFind(6) As String

Dim vReplace(6) As String

' scrub xss vulnerabilites

vOriginal(0) = dirtyString

vFind(0) = {<}

vFind(1) = {>}

vFind(2) = {%3c}

vFind(3) = {%3e}

vFind(4) = {"}

vFind(5) = {'}

vFind(6) = {\}

vReplace(0) = {&lt;}

vReplace(1) = {&gt;}

vReplace(2) = {&lt;}

vReplace(3) = {&gt;}

vReplace(4) = {&quot;;}

vReplace(5) = {&#039}

vReplace(6) = {&#092}

cleanString = Replace(vOriginal, vFind, vReplace)

HTMLEncodeXSS = cleanString(0)

End Function

See bioinformatics.org/phplabware/internal_utilities/htmLawed/index.php and bioinformatics.org/phplabware/internal_utilities/htmLawed/rsnake/RSnakeXSSTest.htm

mdmalph. According to the list at Link it "works" in IE7 too.

We use Juniper for external client authentication, juniper in turn will authenticate with domino server. Login in successfully the user is directed to home page.

Thanks

Akash

I was doing some testing, and even simple things like onmouseover="my malicious script" can get through without careful checking.

For normal (where HTML is not allowed) fields, the following input translation formula works very well:

@ReplaceSubstring(@Trim(@ThisValue); "<":">"; "&lt;":"&gt;");

For fields where HTML IS allowed, I think the blacklist approach would ultimately prove unworkable. I think a whitelist approach is a much better idea.

Anyway, thanks for posting this very helpful series!

-Devin.