Re: IndonesiaHack Advisory HTML injection in PHP Fusebox

[brian428@xxxxxxxxx]

This isn't a vulnerability. The framework is doing what it is supposed to, and 
it isn't the job of the framework to place arbitrary restrictions on what the 
user can pass into it. For example, the CF version of Fusebox has also had this 
"vulnerability" pointed out. But CF already has a mechanism to eliminate XSS 
attacks through the use of the "scriptProtect" attribute of the cfapplication 
tag. So if the core file were to incorporate some sort of XSS scrubbing, it 
would have to be disabled by default so as not to duplicate what the web 
application server is already doing. Which would mean the developer would have 
to turn it on. Which would mean that the developer already was aware of the 
danger of XSS and the need to prevent it. Which would make the addition of 
framework-based scrubbing moot. The framework is there to ease development, not 
stop the developer from making every kind of mistake.