Forum OpenACS Development: Re: What a forking mess: noquote hell.

Please read http://www.cert.org/advisories/CA-2000-02.html

The first fix for "Web Page Developers and Web Site Administrators" is "
Web Page Developers Should Recode Dynamically Generated Pages to Validate
Output" and that is exactly what we did: by default html tags are now quoted
- this is the security aspect.

The more noquote tags in your adp scripts, the less security, you (may have)
captured that quite right.

I don't understand your example though: you created an html file outside of
OpenACS and loaded it and are now wondering about the successfull page
request? This is beyond the scope of the noquote patch. What you describe is
cross-site request forgery and for GET requests OpenACS isn't secured against
that, for post requests it is if you use the form builder.

Have a look here to see what changed in OpenACS code:

http://cvs.openacs.org/cvs/openacs-4/packages/acs-templating/tcl/parse-procs.tcl?r1=1.14&r2=1.15

Now if you adhere to your own high coding standards you can use the noquote
sed oneliners and maybe be getting away with only handful of manual changes.

So if formbuilder protects against XSS, what extra problem does the noquote thing handle?

My example above just shows that you don't need scripting, you just need an image tag, did I really need to delete data or modify my website to prove that to you? Point is, the request is made with my privileges.

And you are absolutely right: changes can be made to form processing to handle the problem. So what was the noquote for again, especially since we are validating input?

It sounds like the noop is a good idea, I'll try it out and post a TIP, or bug/feature. I'm usually less than clear when I write. To summarize, noquote isn't a bad idea, there are other good reasons to use it, mentioned in the original documents referenced above. Upgrading my packages is a good idea, and I had already done one before I started to think, not about doing the upgrade, but about maintaining sites that can't move to 5.0 right away, but might want upgrades to my packages.