On 23 Jun 2006 at 7:55, James C. Slora Jr. wrote: > Amit Klein wrote Thursday, June 22, 2006 3:47 AM > > > So in order to exploit this in HTML over HTTP, the attacker needs to > either add/modify the Content-Type response header, or to add/modify the > META tag in the HTML page. > > There are other ways that might carry a bigger injection threat: > > Style sheet: > http://msdn.microsoft.com/library/default.asp?url=/workshop/author/dhtml > /reference/properties/charset_1.asp > > Object property: > http://msdn.microsoft.com/library/default.asp?url=/workshop/author/dhtml > /reference/properties/charset.asp > > > By extension, it should also work for inline styles. > Good point, thanks. But the main point remains the same - you need to somehow already be in control of the HTML in the page in order for this to work, so in most cases it can't serve the entry point for XSS (because you need some kind of HTML injection in the first place). -Amit
