CERT recently released two papers about the dangers
of using HTML in dynamically generated pages:

Malicious HTML Tags Embedded in Client Web Requests
http://www.cert.org/advisories/CA-2000-02.html

Malicious Web Scripts Redirected by Web Sites
http://www.cert.org/tech_tips/malicious_code_FAQ.html

The CERT papers suggest to filter out most HTML tags,
especially <script>..</script>, and pay attention
to special characters like <, >, &.

Many Wiki clones do allow embedded HTML. The advantage
is that powerusers are not hindered by Wiki systems,
i.e. it is possible to create a form inside a Wiki
page.

Disabling HTML in general plugs the security hole, but
puts some limits on the system. It depends on the
community if this is acceptable or not. For our internal
deployment of TWiki as a knowledge base for support it
is not.

Any comments?

-- PeterThoeny - 05 Mar 2000
-- http://www.mindspring.com/~peterthoeny/twiki/