public class EbayPolicyExample extends Object
eBay (http://www.ebay.com/) is the most popular online auction site in the
universe, as far as I can tell. It is a public site so anyone is allowed to
post listings with rich HTML content. It's not surprising that given the
attractiveness of eBay as a target that it has been subject to a few complex
XSS attacks. Listings are allowed to contain much more rich content than,
say, Slashdot- so it's attack surface is considerably larger. The following
tags appear to be accepted by eBay (they don't publish rules):
<a>
,...
Modifier and Type | Field and Description |
---|---|
static PolicyFactory |
POLICY_DEFINITION
A policy that can be used to produce policies that sanitize to HTML sinks
via
PolicyFactory.apply(org.owasp.html.HtmlStreamEventReceiver) . |
Constructor and Description |
---|
EbayPolicyExample() |
Modifier and Type | Method and Description |
---|---|
static void |
main(String[] args)
A test-bed that reads HTML from stdin and writes sanitized content to
stdout.
|
public static final PolicyFactory POLICY_DEFINITION
PolicyFactory.apply(org.owasp.html.HtmlStreamEventReceiver)
.public static void main(String[] args) throws IOException
IOException
Copyright © 2017. All rights reserved.