Products

Solutions

Resources

Partners

Community

Blog

About

QA

Ideas Test

New Community Website

Ordinarily, you'd be at the right spot, but we've recently launched a brand new community website... For the community, by the community.

Yay... Take Me to the Community!

Welcome to the DNN Community Forums, your preferred source of online community support for all things related to DNN.
In order to participate you must be a registered DNNizen

HomeHomeUsing DNN Platf...Using DNN Platf...Administration ...Administration ...cross-site scripting and custom DNN modulescross-site scripting and custom DNN modules
Previous
 
Next
New Post
12/16/2009 12:21 PM
 

Hi guys!

I've been doing research on cross-site scripting and DNN sites lately. It looks like DNN is doing the majority of work for us. It doesn't even set <pages validateRequest="true"> in its web.config file. As far as I understand, all the work is done in the background by a set of core functions.

1. Please pardon my ignorance, but how does it affect any custom modules built for DNN? Are they being "covered" by the same core functions?

2. Also I came across this article: http://xforce.iss.net/xforce/xfdb/54453. it looks like everything below DNN 5.2 is vulnarable to cross--site scripting. And although it's a medium risk vulnarability, it's advised that we upgrade. Is it correct?

Thank you!

Yulia

 
New Post
12/18/2009 6:11 PM
 

Each individual module handles its own data storage and display.  yes there are core APIs that developers can use to prevent XSS but it is NOT automatically done for all custom modules.

You should evaulate each module individually for any vulnerabilities.


-Mitchel Sellers
Microsoft MVP, ASPInsider, DNN MVP
CEO/Director of Development - IowaComputerGurus Inc.
LinkedIn Profile

Visit mitchelsellers.com for my mostly DNN Blog and support forum.

Visit IowaComputerGurus.com for free DNN Modules, DNN Performance Tips, DNN Consulting Quotes, and DNN Technical Support Services
 
Previous
 
Next
HomeHomeUsing DNN Platf...Using DNN Platf...Administration ...Administration ...cross-site scripting and custom DNN modulescross-site scripting and custom DNN modules


These Forums are dedicated to discussion of DNN Platform and Evoq Solutions.

For the benefit of the community and to protect the integrity of the ecosystem, please observe the following posting guidelines:

  1. No Advertising. This includes promotion of commercial and non-commercial products or services which are not directly related to DNN.
  2. No vendor trolling / poaching. If someone posts about a vendor issue, allow the vendor or other customers to respond. Any post that looks like trolling / poaching will be removed.
  3. Discussion or promotion of DNN Platform product releases under a different brand name are strictly prohibited.
  4. No Flaming or Trolling.
  5. No Profanity, Racism, or Prejudice.
  6. Site Moderators have the final word on approving / removing a thread or post or comment.
  7. English language posting only, please.
What is Liquid Content?
Find Out
What is Liquid Content?
Find Out
What is Liquid Content?
Find Out