Re: Re: Re: XSS and Secure HTML Filtering

2006-11-07 Thread James Bennett
On 11/7/06, Oliver Lavery <[EMAIL PROTECTED]> wrote: > Jing though? Eeep, all them Java VMs firing up could get costly. Perhaps > I'll try to hack it to use xmllint. Well, Jing itself is not so bad, especially when you've compiled it. That system grew largely out of our usage here at World Online

Re: Re: XSS and Secure HTML Filtering

2006-11-07 Thread Oliver Lavery
James,That's perfect thanks! If I have to role my own at least using a validator like relax ng makes it somewhat less painful.Jing though? Eeep, all them Java VMs firing up could get costly. Perhaps I'll try to hack it to use xmllint. Cheers,~olOn 11/7/06, James Bennett <[EMAIL PROTECTED]> wrote: O

Re: Re: XSS and Secure HTML Filtering

2006-11-07 Thread James Bennett
On 11/7/06, Oliver Lavery <[EMAIL PROTECTED]> wrote: > Thanks. Output filtering is definitely a good thing, but I'm more worried > about input filtering. If users are allowed to submit HTML that will be > displayed to other users, I want to pass the HTML through a strict validator > to keep them f

Re: Re: XSS and Secure HTML Filtering

2006-11-07 Thread James Bennett
On 11/7/06, SmileyChris <[EMAIL PROTECTED]> wrote: > When I brought it up on the group a while ago, I hit resounding > silence. It doesn't seem to be the hot topic it was a while back. So bring it up again :) I honestly don't remember seeing it, so it may have come across at a time when everyone