[Zope-Coders] HTML QUoting policy (Was CVS: Zope/lib/python/AccessControl - PermissionMapping.py:1.12 Role.py:1.54)

[Martijn Pieters]

On Thu, Aug 01, 2002 at 06:22:01PM +0200, Florent Guillaume wrote:
> A lot of CMF raises things without quoting them though, not sure what's
> the best plan there.

If any REQUEST data is used that is not expected to contain HTML markup,
quote it. That is always safer. Note that REQUEST data comes from the
client, and a client in a client-server exchange cannot ever be trusted.

If you *do* need to be able to accept HTML markup, or just plain lower-then
and greater-then characters in text where they have meaning outside of HTML,
you will have to use other safety measures. Tres already added such checks
to the CMF, for example.

-- 
Martijn Pieters
| Software Engineer  mailto:mj@zope.com
| Zope Corporation   http://www.zope.com/
| Creators of Zope   http://www.zope.org/
---------------------------------------------