So how do you avoid cross-site scripting on this type of site?
Presumably, people want to be able to bookmark stuff like bookmarklets (little pieces of JavaScript, for example, like the "post to de.lirio.us" magic bookmark you can pick up over at http://de.lirio.us/rubric/doc/help) and you wouldn't want to make that harder.
I don't know how del.icio.us are coping with this -- presumably they would have had to think about it, too -- but here's how I'd do it.
1. Don't display JavaScript in bookmarks, except in the bookmark owner's listing (when she or he is logged in, obviously)
2. Disable HTML altogether in title, description, tags, and body. I don't think the security implications of allowing these can be outweighed by the rather marginal benefit.
2a. In some future version, allow a limited set of tags. Look at what web forums are allowing for a start. (Markup tags like <tt>, <b> etc are not an issue. Limited forms of <:a href="..."> can be allowed, but you need to be specific about what exactly you allow inside the href attribute.)
2b. Entities can probably be allowed without problems, if you think you want to?
3. When people attempt to click or copy such a bookmark, take them to a screen of instructions in the help section. It would need to explain that they don't want to trust other people's scripts blindly, but make it feasible to try out and copy useful bookmarklets.
by
era
2006-06-19 01:23
blog
·
delirious
·
delirioussiteblog
·
deliriouswishlist
·
erablog
·
site
·
20060619-0123
simpy
Watch era
