Re: [htmltmpl] Suggestion on how to eliminate Cross-site-scripting (XSS) bugs for good.

2006-10-25 Thread Mathew Robertson
>> Having read the thread, I don't think that's enough for me. I want to still >> need to explicitly specify "ESCAPE=HTML" everywhere (without having a default >> escape), to have an exception raised on a non-escaped occurence, and to add >> an explicit unescaping (like "ESCAPE="0""). > > Let me s

Re: [htmltmpl] Suggestion on how to eliminate Cross-site-scripting (XSS) bugs for good.

2006-10-25 Thread Jonathan Lang
Shlomi Fish wrote: > Having read the thread, I don't think that's enough for me. I want to still > need to explicitly specify "ESCAPE=HTML" everywhere (without having a default > escape), to have an exception raised on a non-escaped occurence, and to add > an explicit unescaping (like "ESCAPE="0"")

Re: [htmltmpl] Suggestion on how to eliminate Cross-site-scripting (XSS) bugs for good.

2006-10-25 Thread Shlomi Fish
On Tuesday 17 October 2006 14:08, Alex Kapranoff wrote: > * Shlomi Fish <[EMAIL PROTECTED]> [October 17 2006, 14:23]: > > Now what I want is to sub-class HTML::Template so we'll always have to > > use "ESCAPE=HTML". If we want to override it we'll need to do the > > following: > > There's `default_