Re: XSS - Double Quote break out and White Space filtered

[Florian Weimer <fw () deneb enyo de>]

* arvind doraiswamy:

> Problem 1:
> Here's what is allowed:
>
> ( ) : ; &

Is "=" allowed as well?  Without that, it's going to be difficult, I
think.

With =, you can use an onmouseover event handler and a style attribute
to enlarge the input field and make it transparent (so that the event
handler actually fires).  Both can be &-encoded to bypass the filter.
This will work in any browser; direct script injection into style
attributes is quite browser-specific.