html - Is there any way to freeze document.body.innerHTML in JavaScript? -


is there way freeze document.body.innerhtml in javascript attacker unable following:

<script>document.body.innerhtml = document.body.innerhtml.replace("http://www.example.com/" , "http://abc.org" ); </script>

also how freeze document.location? thanks!

no, can't lock contents of dom element javascript. suspect you're asking wrong question here. need plug whatever vulnerability attacker using run code in first place.

  • sanitize user inputs strip out tags
  • sanitize content inserted page db
  • disallow html tags in input application

these place start.


Comments

Post a Comment

Popular posts from this blog

jquery - Invalid Assignment Left-Hand Side -

i trying assign class tag via jquery, resulting in error through firebug says "invalid assignment left-hand side" on fourth line below. <cfoutput> $('.pngfix a').each(function(index) { var hreflink = $(this).attr("href"); if (hreflink.tolowercase() = '../audio.cfm') { $(this).addclass('audioimg'); } }); </cfoutput> looking around online, looks syntax problem, don't seem see it... any tips? thanks if (hreflink.tolowercase() = '../audio.cfm') that attempts assign value, rather check equality. change = operator == .
Read more

javascript - Preserving URL fragment through CAS sign-on -

i maintain single-page application uses yui 2.8 history module retain local options in url fragment. i've put behind cas authentication, , i'm finding fragment gets lost during cas authentication. retained in signon url, not when redirected application page. true after session timeouts, users bumped default options after re-authentication. any suggested strategies hanging on fragment (or underlying javascript state) though cas roundtrip? you can store in cookie, sessionstorage , or value of window.name if there no security implications: //cookie document.cookie = "fragid=" + window.location.hash + ";path=/"; //session storage window.sessionstorage.setitem("fragid",window.location.hash); //window window.name = window.location.hash references url fragments , redirects – ieinternals
Read more

asp.net mvc - Implementing normal user/pass, Twitter & Facebook auth -

i have created public facing website allows login using username/password, or twitter, or facebook. when logging in twitter first time (for example), user created in database nickname matching twitter screen name. want nickname always unique. the problem in cases user nickname exists, user can't added. unsure accepted approach problem, solution can see far ask user override nickname, doesn't seem elegant. the reason nickname needs unique not code issue, interface issue, example there forums , want each user uniquely identified nickname. are there other methods can suggest dealing problem? edit: @ request of of replies clarify example: lets have user named joe bloggs member on website. not member of twitter or facebook. nickname on site joebloggs. then, joe bloggs comes along, , wants sign in twitter account. twitter name joebloggs, when signs in twitter, system attempts automatically set nickname joebloggs. however, nickname exists. normal or best practice ...
Read more