Well, according to this article that id forwarded me, talking about China can be detrimental to your company.  There is a significant risk of either being censored or simply de-indexed altogether by the major search engines for talking about China.  It’s an interesting read.

But more importantly, it seems like the search engines are taking this largely on faith.  They are assuming that the content in question actually IS illegal (or rather that the owners of the site are even aware of it’s presence at all).  What happens if I inject content that is deemed illegal into Microsoft’s website?  Does that mean that suddenly Google will censor them and MSN themselves will de-list themselves?  The ramifacations here are pretty dramatic depending on how far you take it.

The ultimate problem here is that injection, not of code, but illegal words or content in general - whether it be terrorist information, Chinese curse words, or child pornography is largely out of control of the website administrators for most dynamically generated websites.  There are mitigation factors, but I’ve only seen them put in place a handfull of times.

This entry was posted on Tuesday, June 20th, 2006 at 9:04 am and is filed under XSS, Webappsec. You can leave a response as well.