Quantcast
Channel: Comments on: XSS: Cross-Site Scripting – Basic Security Part 2
Browsing latest articles
Browse All 7 View Live

By: Wladimir Palant

One thing that I don’t understand: why leave markup to translators? Then you still have to worry about JavaScript added to some obscure translation because a translator’s account has been hacked....

View Article



By: James

Ideally, you don’t leave markup in localized strings. Sometimes it’s unavoidable, to be able to localize correctly and still make it look correct. The examples above are real, from support.mozilla.org....

View Article

By: Wladimir Palant

In these scenarios like this one I give translators a string like “To grob a fobster [link]click here[/link].”. So translators don’t get any markup, merely some markers (that might produce different...

View Article

By: James

It also depends a lot on who your localizers are, and how they access the .po files. At Mozilla, or in open source in general, maybe we should be more cautious, with community localizers. At totally...

View Article

By: ryan

Your jQuery example doesn’t do the same thing as your DOM example. The equivalent jQuery is: $("", {text: username}).appendTo($("#subhead").empty()); Pedantic, I know.

View Article


By: ryan

$("<h2>", {text: username}).appendTo($("#subhead").empty()); (It ate the arrow brackets. BTW, a note under the comment form saying that the form supports HTML and what tags are allowed would be...

View Article

By: James

About the examples: I know. The DOM example is kind of The Wrong Way, because you need to be so much more careful. Your way is much better, if I couldn’t restructure things to put the <h2> tag...

View Article
Browsing latest articles
Browse All 7 View Live


Latest Images