HTML5 Security Cheatsheet(heideri.ch)
heideri.ch
HTML5 Security Cheatsheet
http://heideri.ch/jso/
3 comments
What is this, a cheatsheet for creating an HTML5 blacklist? Why would you ever do such a thing?
Or perhaps a [:white, :grey, :black].sort_by{rand}.first hat attack vector list? Penetration testers love this stuff, as do I. At my job, I educate developers by documenting things like this. It helps them be aware of what crazy stuff is out there.
Almost all of them can be prevented by escaping < and ".
But not all of these can: http://ha.ckers.org/xss.html. This is an older, but much more complete list.
don't forget
' & >Holy crap, that is indeed very useful.