Neal Poole🔒 SSL Verified

Table of Contents

• ↓ CodeIgniter <= 2.1.3 xss_clean() Filter Bypass
• ↓ XSS Filter Bypass in validator Node.js Module
• ↓ Code Execution via F5 Networks Java Appplet
• ↓ Bitbucket: User Information Disclosure via JSONP
• ↓ Code Execution via YAML in JS-YAML Node.js Module
• ↓ CSRF Token Disclosure in Coinbase
• ↓ Top Alternatives to nealpoole.com

6-Month Traffic Trend Estimate

Official Contact & Profiles

Visual representation extracted from nealpoole.com

Content Snippets from nealpoole.com

"The CodeIgniter framework contains a function, xss_clean(), which is intended to filter out potential XSS attacks. From the CodeIgniter documentation:"

"The XSS filter looks for commonly used techniques to trigger Javascript or other types of code that attempt to hijack cookies or do other malicious things. If anything disallowed is encountered it is rendered safe by converting the data to character entities."

"I identified a form of malicious input that would bypass the xss_clean() filtering, allowing for arbitrary JavaScript to be executed. The vulnerability has been patched in CodeIgniter 2.1.4. Any developers relying on xss_clean() as a form of protection should upgrade their application to the latest version of the framework."

"The vulnerability is straightforward to understand. The xss_clean() function would only strip attributes from HTML tags that were properly closed. However, browsers which see unclosed tags can choose to parse them as though they were properly formed."

Key Topics & Focus Areas for nealpoole.com:

CodeIgniter <= 2.1.3 xss_clean() Filter Bypass

XSS Filter Bypass in validator Node.js Module

Code Execution via F5 Networks Java Appplet

Bitbucket: User Information Disclosure via JSONP

Code Execution via YAML in JS-YAML Node.js Module

CSRF Token Disclosure in Coinbase