POST binding URL now escaped, why?

[Etienne Dysli]

On 31/08/11 15:06, Chad La Joie wrote:
> It's magic.

Magic like Velocity's EscapeTool? ;)

> As part of one of the security issues we went through and made sure
> all the data we were putting in to HTML forms was probably encoded for
> the particular HTML data structure that bore the information.  So,
> what you're seeing is the proper encoding of a URL within an
> attribute.  Assuming no other bugs or invalid data anywhere else in
> the system that would not have been strictly but, obviously, thats
> never a good assumption to make.

OK I see, that's linked to the XSS in Velocity templates. Thanks for the
quick answer Chad!

Regards,
   Etienne

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 554 bytes
Desc: OpenPGP digital signature
Url : http://shibboleth.net/pipermail/users/attachments/20110831/0084ee79/attachment.bin