<?xml version="1.0" encoding="UTF-8"?><rss version="2.0" xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:wfw="http://wellformedweb.org/CommentAPI/" xmlns:dc="http://purl.org/dc/elements/1.1/"><channel><title>Reflection comment feed for XSS vulnerabilities in the Blog4Umbraco package.</title><link>http://blog.bigfinger.se</link><pubDate>2012-02-07T23:33:46</pubDate><generator>umbraco</generator><description>Thoughts on life: Umbraco, EPiServer, .NET and Fatherhood.</description><language>en</language><copyright>Copyright 2009-2012 Stephan Kvart</copyright><webMaster>stephan@bigfinger.se</webMaster><item><title>
          Re XSS vulnerabilities in the Blog4Umbraco package. by Anders Brohäll</title><link>http://blog.bigfinger.se/2010/1/26/xss-vulnerabilities-in-the-blog4umbraco-package.aspx#comment-6</link><pubDate>Tue, 26 Jan 2010 14:09:19 GMT</pubDate><guid>http://blog.bigfinger.se/2010/1/26/xss-vulnerabilities-in-the-blog4umbraco-package.aspx#comment-6</guid><content:encoded><![CDATA[ Don't forget that you can parse <> as \u003c\003e! The  Server.HtmlEncode isn't enough protection. <br/>
<br/>
Did you take a look at the http://antixss.codeplex.com/ project yet? Their encoders does look good!]]></content:encoded></item></channel></rss>
