| http://www.w3.org/ns/prov#value | - For example, in PHP the following will retrieve the value of the User-Agent header:$_SERVER['HTTP_USER_AGENT']Predictably enough, a Flash object can be used to spoof a header containing the non-standard name:req.addRequestHeader(User_Agent, <script>alert('xss')</script>);This is not blocked by the fix to the original problem, and yet in many languages (most notably PHP, Perl, Ruby and ColdFusi
|
