SKye's Blog

Fravia's web-searching lore: Main entrance: Finding Information and Knowledge on Internet

I had to make a mention of this site on my blog, because it seems to be some sort of Holy Grail... Whether you wear a "Black Hat" or a "White Hat", or maybe your hat is a little checkerboard of black and white...

(sorry for the following text, I put it in PRE tags because of all the special characters)

Anyway, I'm not sure what I can say on it's usefulness, I'm trying to secure a  field
input that will be used as an HTML link, it is  only  to  allow  a  certain  URL  and
allow the user to append their custom data, consider  blogspot..  When  you  sign  up
they have you create a page by presenting you a text box followed by blogspot.com  so
it   looks   something   like    [___].blogspot.com,    mine    looks    more    like
http://www.___.com/x.abcd?[_____] where the INTENDED input would be  something  like:
username=kkkkkkk&password=DK.F988FEEILLSSIICCPPSSE876  (or  something   to   that
effect), and users will be able to create a custom link  so  that  when  they  go  to
http://www.___.com/easy?[___] then it will automatically  log  them  in  (it  doesn't
need to be secure, it is a url that you give to your friends so they can "join"  your
chatroom, but so you don't have to give a MILE long URL), so the  program  that  will
allow someone to create this url has two input fields, one where you can "name"  your
short URL, and one where you enter the MILE  long  data  (which  will  contain  dots,
letters, numbers, possibly an ampersand and an equal sign).

I'm  trying  to  find  out  if   making   sure   that   every   entry   begins   with
http://www.___.com/x.abcd?, AND blocking any input with the following characters:  <,
>, 'PIPE symbol' , ^, %, @, ", ', \, [, ], #, {, }, (, ), *, AND  allow  only  ONE  :
(hyphen) and ONE ?(question mark).

Is that enough to block HTML URL exploits? Can someone inject code following the  URL
http://www.___.com/xabcd?[___]? code that fits the above restrictions? If so, let  me
know. :) Thanks.

(0) comment(s): Post a Comment http://dskye.blogspot.com/2007/03/fravias-web-searching-lore-main.html