  Re: <iframe doc="">  From: Shelley Powers
<shelley.just@gmail.com> Date: Mon, 25 Jan 2010 08:34:07 -0600
Message-ID:
<643cc0271001250634i366c8d11p5af2df80b4c68d20@mail.gmail.com>
To: Maciej Stachowiak <mjs@apple.com> Cc: Lars Gunther
<gunther@keryx.se>, "public-html@w3.org WG" <public-html@w3.org>
On Mon, Jan 25, 2010 at 4:16 AM, Maciej Stachowiak
<mjs@apple.com> wrote: > On Jan 25, 2010, at 2:03 AM, Lars
Gunther wrote: >> 2010-01-24 18:14, Tab Atkins Jr. skrev: >>>
Indeed, there are nearly as many html-sanitizers as there are
CMSes. >>> And they're pretty uniformly bad.  Most of them are
built on fragile >>> regexps, if you're lucky.  They might just
be a handful of string >>> replaces that address whatever
problems the CMS author could think of >>> at the time.  The
best of them address *currently known attack >>> vectors*
decently enough, but are usually weak to*new*  attacks. >> There
are white list approaches as well that one can use and indeed
that are being used. I know of and have written a few myse