Re: Re: Re: Apache Server HTML Injection and UTF-7 XSS Vulnerability

[Tom.Donovan@acm.org]

Setting the HTTP response header:
Content-Type: text/html; charset=iso-8859-1

or adding the tag:
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">

or even both - still does not deter IE from scanning the contents and interpreting them as UTF-7 when Encoding=Auto-Select.
(observed on w2k with IE 6.0.2800.1106 SP1 + Q867801 + Q823353 + Q833989 + Q903235)

It appears there is little that web servers can do to thwart this, short of changing all '+' characters to %2B. That seems excessive.

-tom-

[Jon Ribbens]

On Wed, May 14, 2008 at 05:20:52PM -0000, Tom.Donovan@acm.org wrote:
> It appears there is little that web servers can do to thwart this,
> short of changing all '+' characters to %2B. That seems excessive.

To be fair, this is what Microsoft has recommended, explicitly for the
purpose of preventing XSS, for *at least* the last 6 years. The library
I use does indeed encode "+" as "&#43;".