<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">If someone would like to start a security discussion re: scripts in X3D and converting to X3DOM or security in shaders for WebGL, I would be open.<div class=""><br class=""></div><div class="">John<br class=""><div><blockquote type="cite" class=""><div class="">On Jan 17, 2016, at 4:21 AM, John Carlson <<a href="mailto:jcarlsonprivate@gmail.com" class="">jcarlsonprivate@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><meta http-equiv="Content-Type" content="text/html charset=utf-8" class=""><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">You should not put up index.html from the X3D JSON Loader found here <a href="https://github.com/coderextreme/X3DJSONLD/" class="">https://github.com/coderextreme/X3DJSONLD/</a> and here <a href="http://coderextreme.net/X3DJSONLD/" class="">http://coderextreme.net/X3DJSONLD/</a> without careful consideration of this:<div class=""><br class=""></div><div class=""><a href="https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet" class="">https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet</a></div><div class=""><br class=""></div><div class="">In particular, I am choosing tags, attribute names, and attributes right out of the JSON and XML without any filtering or checking. You should validate any JSON or XML being loaded into the X3D JSON Loader (yes I know it’s problematic). In particular, if you store XML or JSON from untrusted sources and display them in the Loader, it’s likely you will get an XSS attack. Please sanitize all input from untrusted source and make sure it’s valid. We don’t currently have XML Schema or XML Schematron for JSON data yet.</div><div class=""><br class=""></div><div class="">It’s in the license that I will not be liable for damages. Please use my software with care. I am not a security researcher.</div><div class=""><br class=""></div><div class="">If someone wants me to write a sanitizer for the X3D JSON Loader, I am willing to for $$$. I will need to run it by some security researchers.</div><div class=""><br class=""></div><div class="">John Carlson</div></div>------------------------------------------------------------------------------<br class="">Site24x7 APM Insight: Get Deep Visibility into Application Performance<br class="">APM + Mobile APM + RUM: Monitor 3 App instances at just $35/Month<br class="">Monitor end-to-end web transactions and take corrective actions now<br class="">Troubleshoot faster and improve end-user experience. Signup Now!<br class=""><a href="http://pubads.g.doubleclick.net/gampad/clk?id=267308311&iu=/4140_______________________________________________" class="">http://pubads.g.doubleclick.net/gampad/clk?id=267308311&iu=/4140_______________________________________________</a><br class="">x3dom-developers mailing list<br class="">x3dom-developers@lists.sourceforge.net<br class="">https://lists.sourceforge.net/lists/listinfo/x3dom-developers<br class=""></div></blockquote></div><br class=""></div></body></html>