Some progress/ some frustration
The Computer Security department of TU Berlin kindly agreed to host a presentation about my diploma thesis on Tuesday, Dec 18th. I was able to talk to a very technically versed audience about my (not so) new technical approach to XSS and SQLIA (“let the framework take care of it”). Thanks a lot, guys!
Despite the fruitful discussion I’m still not sure about the feasibility of a “rich types in frameworks” solution. There’s not too much to be gained over a conservative approach used in e.g. Django (escape everything, use other markup languages than HTML).
Nevertheless, here’s the presentation…