well i have a theoretical question. first of all, i really appreciate your plugin, it works great. my question regards the use of javascript:

at this time, should it be considered best practice to never include javascript authentification mechanisms (a.k.a. username and passwd)
for logins on web pages?! in other words, i notice visiting various sites across the web, that authenticating (authentifying?) mechanisms always seem to work, but there have been exceptions…………

another scenario might be that sometime in the future, i might consider building a website/web server, but because of my sysadmin/networking background, i would never choose to use a bunch of interactive eye candy on sites, capabilities which can be provided by javascript or flash for example.

i have to confess i am not so informed of the inner workings of java or javascript, but i do understand the concepts of buffer overflows or similiar exploits that can be deployed via a running process’s priveledges etc–in other words, i am looking at this from a infosec view.

Many thanks for your help and your tools. It’s also a great learning resource for those not so skilled in the inner workings of web technologies.

regards,

Adriel

XSL documents are stylesheets used to transform other XML documents, usually for presentation purposes. ABP does already stylesheet blocking, so you can block XSLs if you want (with some effort to tell CSS from XSL, which I’m not sure how trivial is in ABP, unless it checks also for MIME type). But again, if you’re doing it for security purposes you should look elsewhere, because a motivated attacker will pwn you anyway.