[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [WEB SECURITY] countermeasure against attacks through HTML shared files

There's a very short reference from May 2007 to the concept of using different hostnames to protect against XSS:

See Brian Eaton's post to WebSecurity mailing list, May 18th, 2007, titled "Re: [WEB SECURITY] How to avoid XSS into PDF Files, using java".


fcorella@xxxxxxxxxx wrote:

I wanted to announce a Pomcor white paper that
looks at attacks through HTML shared files in Web
applications and proposes a countermeasure.  These
are essentially XSS attacks, but the usual
defenses against XSS are typically not available,
because shared files cannot be sanitized.

The paper is available at:


I have not been able to find much prior work.
What I've found is discussed in Section 2 of the
paper.  If I've missed something, please let me


Francisco Corella

Join us on IRC: irc.freenode.net #webappsec

Have a question? Search The Web Security Mailing List Archives: http://www.webappsec.org/lists/websecurity/archive/

Subscribe via RSS: http://www.webappsec.org/rss/websecurity.rss [RSS Feed]

Join WASC on LinkedIn