How do I get around global script protection in my CMS?

We have global script protection enabled on our CF server. I am the admin with full rights. The tags it scans for and replaces with "invalidTag" are these, which are located in the neo-security.xml file:
object|iframe|embed|xss|script|javascript|applet|meta
However, we ocassionally introduce these tags into pages controlled by our CMS, which of course go into a database. When that happens the tags are replaced with "invalidTag".
I want and need script protection enabled to prevent against hackers, but I also want to be able to add these tags to our local CMS. What is the best way around this? Right now, I actually had to remove "object" and "embed" from the list it scans against, but I feel like this defeats the purpose.
When I Googled this issue I saw a couple of hacks that had something to do with re-writing the tag after it was sent into the database, but that seems kind of polish to me. I'm wondering if I'm missing some simple trick to get around this. But then I guess if I could, a hacker could.
Thanks for any advice.

Thanks for clearing that up. I think you said it succinctly yourself: 'I actually had to remove "object" and "embed" from the list it scans against, but I feel like this defeats the purpose'. I think it's a matter of weighing the risks and the benefits, and then making a choice.

Similar Messages

How do you get around password protection?

i recently bought an apple graphite g4 tower running O.S. X.
i got home and set it up, but it won't let me update anything.
anybody know how to get around the password protection?

Dorian,
As stated by reese, if you boot off of the install disk you will have options to do things that are not available when running the system.
Apple includes on the install disk a utility for your hard drive that does not come on Windows install disks (AFAIK). You can do repairs on the hard drive, erase and reformat it, partition it, etc..
There is also (under File on the top menu bar) a little utility for changing the password.
The only issue that you may run into is that if the install disk is not a retail/universal, the rom files for booting your particular computer may not be on the disk. This is likely if the install disk you are trying to use is from an imac or ibook.
As for getting around password protection, I suppose it is possible. But the National Security Administration considers the mac, with its password protection schemes, to be one of the more secure systems on the market. It is one of the reasons that the install disks have that little utility for resetting the password.
One last thing. The password reset does depend on the system files to be in order. If the directory was messed up the password reset may not proceed. I have had that happen some time ago.

Preprocessor command, assigned the variable and then compare the variable to int. How can I get around this?

#define ON 1
#define OFF 0
in seperate code
int variable = ON;
variable is globally define for that module.
in seperate code
if (variable == ON)
the complier errors off on the if (variable==ON)
My guess variable is variable in of type int and ON is a preprocessor command. Therefore it is a mismatch and complier doesn't like it. How can I get around this.
thank
Mahen

Mahen
What is the exact message of the compiler?
I think the error is, that the compiler does not find the definition of ON
and OFF. Is it in the same source file?
If not, try to put it into an .h file and include it where you need it.
Stephan
"Mahen" schrieb im Newsbeitrag
news:[email protected]..
> Preprocessor command, assigned the variable and then compare the
> variable to int.
>
> How can I get around this?
>
> #define ON 1
> #define OFF 0
> in seperate code
>
> int variable = ON;
> variable is globally define for that module.
> in seperate code
> if (variable == ON)
> {
>
>
> }
>
> the complier errors off on the if (variable==ON)
> My guess variable is variable in of type int and ON is a preprocessor
> c
ommand. Therefore it is a mismatch and complier doesn't like it. How
> can I get around this.
> thank
> Mahen

Global Script Protect and data uploading

I need to allow some users to upload data to our database
that includes html tags. When global script protect is on all these
tags are made safe and the content loses its formatting.
When I disable global script protect it is possible to load
an iframe externally to simulate a cross-site script attack.
How can I prevent the cross site scripting but still allow
users to upload html content to the database?
I'm using Fusebox 3 if that matters.

echowebs wrote:
>
> isn't there a more beneficial 'server compliant' way to
> parse all these things than having to parse them on
every page call on my site?
> Sorry I am venting b/c I have spent hours on this crazy
thing this morning and
> it is driving me nuts :)
>
> thanks Ian
>
Well, not with ColdFusion. Since by the time ColdFusion gets
the
request it is too late for a server option. You, of course,
could
easily put such search logic in an Applicaton.cfm|.cfc
template that is
automatically run every request. But yes, ColdFusion based
tools will
run every request.
If you want something 'server compliant' then you need to
look at the
setting and configuration options of your web server, i.e.
IIS or
Apache. This is the system that could do something more
globally. I do
not know what, since I have never had to deal with this
level.
But, the reality of HTTP based systems, is that every request
is
unqualifiedly untrusted and if you must build a secure system
you just
have to work with that situation. Every request could include
malicious
code in the Get, Post, Cookie, etc and if you just process
this data
without screening it, then trouble can insue.

Enabling Global Script Protection is not working while adding "&"

Hi All,
To prevent crosssite scripting attacks I ticked the the check box "Enable Global Script Protection" in CF admin. But it is not working , I mean not able to prevent the scripting attacks.
Steps I followed
1] I executed the below URL.
https://xyz.abc.com/index.cfm?cardholder_number=&<script>alert(1)</script>
2] In the fornt end I got a javascript alert message as injected in the URL.
But this alert message should not come as I have enabled script protection in CF admin. Right????
Now I removed "&" (https://xyz.abc.com/index.cfm?cardholder_number=<script>alert(1)</script>) from the above URL then I was not getting the javascript alert message. Does this mean that script protection will not work if we are adding "&" to the URL????.
I searched the neo-security.xml and its looks like below.
<var name='CrossSiteScriptPatterns'><struct type='coldfusion.server.ConfigMap'><var name='<\s*(object|embed|script|applet|meta)'><string><InvalidTag</string></var></st ruct></var>
Can any one help me out to fix this.

Abdul L Koyappayil wrote:
But still one doubt remains why alert message is coming only when there is "&" in the URL??
This happens with "&" because it is a special Javascript symbol whose purpose is to delimit - that is, separate - the key-value value pairs in the URL's query-string. For example, in the URL www.myDomain.com/index.cfm?a=1&b=2, the "&" delimits the query-string into the 2 key-value pairs
a=1
b=2
Let us then consider the case where the URL is www.myDomain.com/index.cfm?cardholder_number=&<script>alert(1)</script>. The & will delimit the query-string into
cardholder_number=
<script>alert(1)</script>
The presence of '&' implies there are 2 variables. However, there is only one '=' sign, which means there is just one key-value pair. In addition, cardholder_number is a legal name for a URL variable, whereas <script>alert(1)</script> is not. The browser therefore sends the following query-string to your application
cardholder_number=EMPTY_STRING&<script>alert(1)</script>
However, Coldfusion's scriptprotect feature will intervene and neutralize this to
cardholder_number=EMPTY_STRING&<invalidtag>alert(1)</script>
which is harmless. These will enter into Coldfusion as the URL variables
cardholder_number=EMPTY_STRING
EMPTY_STRING=EMPTY_STRING
The special nature of '&' as delimiter is what prompts the browser to run the script. In fact, by default, browsers will run any Javascript that you place in the query-string. Run this, for example
http://www.myDomain.com/index.cfm?<script>alert(1)</script>
But what reason will I say if they are asking me why javascript alert is coming then.
As you have just seen, the <script> tag cannot come in. The alert occurs at the browser - that is, at the client - but Coldfusion runs at the server. Communication between client and server is by means of the URL variables that the client sends to the server. For the attack to be effective, it has to be sent in the form
sneakyVar=<script>alert(1)</script>
That is not the case here.

I was recently blocked from using app Jack'D. Message I receive says "Your device has been blocked". How can I get around this?

I was recently blocked from using app Jack'D. Message I receive says "Your device has been blocked". How can I get around this?

Quoted from their FAQ's:
I got an error message saying my device is blocked. Why did this happen?
There are two reasons this could happen: You have deleted your account or you have been banned due to violation of terms of service.
- You have deleted your account.
When you delete your account, you agree that your device would be blocked for at least one month. This policy is enforced in order to protect users from stalkers. (If the system allowed users to create and delete their accounts any time they wanted, the Block feature would be compromised and wouldn't be able to protect users effectively.) Please understand this is not a punishment but a security measure intended to keep all of our users safe.
- You have been banned due to violation of terms of service.
Users of this mobile application are required to comply with our terms of service and instructions provided by our service team. The most common violations include, but are not limited to: Creating multiple accounts, uploading pictures not complying with our terms, and abusing the Report feature. In most situations, you will get a warning before you are banned from the app. If you receive a warning from our service team, please read it carefully and take it seriously. If anything is not clear, please contact user support for clarification.

How do I get around the "Master Password" window?

Since I'm the only user at this sight, I don't think that I need a Master Password.
So How do I get around the "Master Password" window so I can get some work done?
The Box is not marked, but setup still refuses to go any further.

Hi warp4dennis,
Thank you for your question, I understand that you would like to get around the master password dialogue. [[Master Password]] specifically [https://support.mozilla.org/en-US/kb/use-master-password-protect-stored-logins#w_removing-the-master-password how to remove it]
I hope this helps!

I accidently deleted Safari and now I can't reinstall because it keeps telling me there is a newer version on my computer. The issue is my system does not support the newer version. Does anyone know how I can get around this?

I accidently deleted Safari and now I can't reinstall because it keeps telling me there is a newer version on my computer. The issue is my system does not support the newer version. Does anyone know how I can get around this?

Apple wanted to charge me 50 bucks jsut to talk to someone!
I believe you may be referring to the $49 ASL agreement at AppleCare? That is only when/if you are out of AppleCare Protection.
Can you get to an AppleStore Genius Bar?
They may be able to fix this for you. No charge.
I highly doubt that. There is a $70 charge for troubleshooing software issues, EVEN IF there is AppleCare Warranty on the hardware.
However, since there is no charge for an appointment at a Bar, go make one, and see what options they give you. Let us know how it goes.

I'm trying to download itunes 10 but I get to a point in the download and it tells me, "The feature you are trying to use is on a network resource that is unavailable" but I haven't had itunes on my computer for a year now so how can I get around this?

I'm trying to download itunes 10 but I get to a point in the download and it tells me, "The feature you are trying to use is on a network resource that is unavailable" but I haven't had itunes on my computer for a year now so how can I get around this?

iTunes.msi
Perfect, thanks.
Download the Windows Installer CleanUp utility from the following page (use one of the links under the "DOWNLOAD LOCATIONS" thingy on the Major Geeks page):
http://majorgeeks.com/download.php?det=4459
To install the utility, doubleclick the msicuu2.exe file you downloaded.
Now run the utility ("Start > All Programs > Windows Install Clean Up"). In the list of programs that appears in CleanUp, select any iTunes entries and click "Remove", as per the following screenshot:
Quit out of CleanUp, restart the PC and try another iTunes install. Does it go through properly this time?

I have an ipad and just bought a second one for my daughter and she wants all my music on her ipad. We both have our own itunes accounts and music match wont let me put music on hers. how do i get around this?

I have an ipad and just bought a second one for my daughter and she wants all my music on her ipad. All the music is under my itunes account yet she has her own itunes account so she can have her own apps and purchase apps with gift cards (She's only 9)
I subscibe to music match under my account but it wont let me put my music on her ipad under hers or even my itunes account. I get some sort of 90 day error message. How do i get around this so I can let her have my music on her ipad?

iTunes Match is not sharable across Apple IDs. The best way to get the music on her iPad is to leave hers signed into her Apple ID on the iTunes Store and sync via USB.

Hi, I have just purchased a ipad mini for my wife and have registered it in my name so that i can add some apps that i think she would appreciate. However if i want to contact her using face time it is registered in my name, how do you get around that?

Hi I have just purchased an i pad for my wife and have registered it in my name to add some apps prior to giving the i pad to her. However, for using face time and games where you can link via wifi it will look as though there are two of the same, if I am trying to link her ipad to mine. How do you get around this?

Assign an email address (gmail.com?)
Using FaceTime http://support.apple.com/kb/ht4319
Troubleshooting FaceTime http://support.apple.com/kb/TS3367
The Complete Guide to FaceTime + iMessage: Setup, Use, and Troubleshooting
http://tinyurl.com/a7odey8
Troubleshooting FaceTime and iMessage activation
http://support.apple.com/kb/TS4268
Using FaceTime and iMessage behind a firewall
http://support.apple.com/kb/HT4245
iOS: About Messages
http://support.apple.com/kb/HT3529
Set up iMessage
http://www.apple.com/ca/ios/messages/
iOS 6 and OS X Mountain Lion: Link your phone number and Apple ID for use with FaceTime and iMessage
http://support.apple.com/kb/HT5538
How to Set Up & Use iMessage on iPhone, iPad, & iPod touch with iOS
http://osxdaily.com/2011/10/18/set-up-imessage-on-iphone-ipad-ipod-touch-with-io s-5/
Troubleshooting Messages
http://support.apple.com/kb/TS2755
Troubleshooting iMessage Issues: Some Useful Tips You Should Try
http://www.igeeksblog.com/troubleshooting-imessage-issues/
Setting Up Multiple iOS Devices for iMessage and Facetime
http://macmost.com/setting-up-multiple-ios-devices-for-messages-and-facetime.htm l
FaceTime and iMessage not accepting Apple ID password
http://www.ilounge.com/index.php/articles/comments/facetime-and-imessage-not-acc epting-apple-id-password/
Unable to use FaceTime and iMessage with my apple ID
https://discussions.apple.com/thread/4649373?tstart=90
How to Block Someone on FaceTime
http://www.ehow.com/how_10033185_block-someone-facetime.html
My Facetime Doesn't Ring
https://discussions.apple.com/message/19087457
To send messages to non-Apple devices, check out the TextFree app https://itunes.apple.com/us/app/text-free-textfree-sms-real/id399355755?mt=8
How to Send SMS from iPad
http://www.iskysoft.com/apple-ipad/send-sms-from-ipad.html
You can check the status of the FaceTime/iMessage servers at this link.
http://www.apple.com/support/systemstatus/
 Cheers, Tom

HT5622 when i try to sign in to my Icloud account i get this message"The Apple ID is valid but not an icloud account" i only have the one ID so how do I get around this please

when I try to sign in to my Icloud account on my windows PC i get this message"The Apple ID is valid but is not an icloud account" i only have the one apple
ID so how do I get around this please ??

note I own no other Apple device I just wanted to use icloud for data storage and Itunes

I spilled water on my laptop and my "i", "j" and "k" letters don't work on my laptop. However my main problem is that my password contains an "i" so i am locked out of my computer. Any ideas how I can get around the password and login.

I spilled water on my laptop and my "i", "j" and "k" letters don't work on my laptop. However my main problem is that my password contains an "i" so i am locked out of my computer. Any ideas how I can get around the password and login. I tried the method where you go into single user mode and type in commands, however that method uses some of the letters that are not working on my laptop.

You didn't mention which version of OS X your running but there are password reset utilities provided OS X: Changing or resetting an account password (Snow Leopard and earlier) - Apple Support or OS X: Changing or resetting an account password - Apple Support
Alternately you can use an external keyboard to log in and change the password. Make a backup if you don't have one, it's likely that your problems aren't over. If that water continues to migrate downward and fries the logic board your macbook will be toast.

Imovie on my ipad ...refuses to recognize AVCHD Video. Also when i remove video clips already used in a project, it is unable to recognize missing clips after I've put them back. How do I get around these 2 issues?

My iMovie refuses to recognize, import, or work with AVCHD Video. It also refuses the same video clips even after I have converted them to Mp4. Also, when I delete a video clip already used in a project, then later import the same clip back to my ipad, the software is unable to recognize and find the clip again! Help! How do I get around these issues?

Hi Craig,
I also got the second problem. The storyboard on iMovie trailer has all these missing videos. If I import them on my iPad it doesn't find them.
If you find a solution it would be much appreciated to share it here ... I'll do the same.
Thanks,
Rafael

When I use my Apple ID for the last 12 hours I get this response: "There was an error in the App Store. Please try again later. (4)". How do I get around this? Try two apple ID's. Same thing.

When I use my Apple ID for the last 12 hours I get this response: "There was an error in the App Store. Please try again later. (4)". How do I get around this? Try two apple ID's. Same thing.

What does it mean when I get...: Apple Support Communities
'there was an error in the App Store....: Apple Support Communities

How do I get around global script protection in my CMS?

Similar Messages

Maybe you are looking for