Signs on the SandOleg Tkachenko's BlogXSLT and XSS attacks- November 7, 2007 I noticed Robert Robbins was writing about XSS attacks using XSLT: It is possible to extend the power of XSLT using JavaScript embedded into the XSL file. Therefore any web application that allows the user to upload their own XSL file will be vulnerable to Cross Site Scripting attacks. Well, that's not exactly true, at least on Microsoft platform. Microsoft tackled this issue long time ago. Both MSXML 6.0 and .NET (since 2.0) don't allow script extensions and...http://www.tkachenko.com/blog/archives/000726.html |