XSS filtering and Sandbox
Posted: Thu Jan 09, 2014 2:10 am
From what I understand of the Sandbox action for ABE, it appears to be intended for XSS defence. You block all active content on the landing page so that the injected script can't run.
Would it be feasible to actually integrate this behavior with the XSS filter, so that (optionally) it could block active content when a suspected attack is found, instead of sanitising the request? So, the 'Sanitize cross-site suspicious requests' checkbox would become a pair of radio buttons, where you choose either 'Sanitize request' or 'Deactivate response'.
Would it be feasible to actually integrate this behavior with the XSS filter, so that (optionally) it could block active content when a suspected attack is found, instead of sanitising the request? So, the 'Sanitize cross-site suspicious requests' checkbox would become a pair of radio buttons, where you choose either 'Sanitize request' or 'Deactivate response'.