The purpose of the WASC Script Mapping Project is to come up with an exhaustive list of vectors to cause a script to be executed within a web page without the use of tags. This data can be useful when testing poorly implemented Cross-site Scripting blacklist filters, for those wishing to build an html white list system, as well as other uses.
Originally this project was scoped to check the W3C tags and event attribute combinations to identify which events can be fired in a given tag. After community discussion we extended the project to test for and map the different ways script can be executed by a browser without the use of the script tag. This will be identified via a combination of custom automated test suites and manual review when applicable.
To make the data more manageable we will be publishing our results in different phases.
The list of script execution vectors is still being scoped, and we are open to suggestions. If you would like to be involved with the project, please contact Romain Gaucher.
No comments:
Post a Comment