Javascript security

[robdon]

Hi,

I have a web site that has a forum on that I have programed in HTML,Javascript and Perl on a Linux Box with Apache.

I allow the users to enter HTML and Javascript tags in the message area.

Could this open some REAL security issues.

I know that there are ways for someone to redirect cookies to another site, but I dont use cookies for any sensative data.

Any other problems anyone can think of?

Thanks for any help,

Rob Donovan

 

[GoldenEternity]

There have been recent threads on this subject on bugtraq. I also believe that this was the method used to deface alldas.de recently.

 

[rycamor]

See

http://www.phpbuilder.com/columns/ying20000718.php3

and

http://www.phpbuilder.com/columns/sporty20001102.php3

Basic rule: trust no one.

 

[DarkShad]

Exploits make it possible to enter abitrary code which infact could disrupt some systems by the use of that code into html pages. Java tags alone seems to play little towards disruption, active x would be another story.