Other nomination

Posting raw XML cross-domain

Chris

Sending arbitrary XML to another origin normally needs XHR, which the same-origin policy blocks. A plain form using enctype text/plain does no percent-encoding, and because XML is full of '=' characters a single name/value pair can carry a whole element, splitting at the first '='. It works on Opera, IE and Firefox; WebKit browsers still encode and convert spaces to '+'.

Record

Researcher

Chris

In the archive

• Nominated for the 2010 Top 10 Web Hacking Techniques

Tags

• csrf
• sop-bypass
• content-type
• parser-differential
• http
• filter-bypass
• owasp-a01-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of Chris, first published at the original source. Preserved copies are kept so the citation survives its host.