<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">Hi Ben<div><br></div><div>The Ensembl webcode is included in the Sanger Institute’s regular security audit, but of course problems can creep in between audits.</div><div><br></div><div>If you could send the details of the security loophole directly to us at <a href="mailto:ensembl-webteam@sanger.ac.uk">ensembl-webteam@sanger.ac.uk</a>, we can look into it further.</div><div><br></div><div>Thanks</div><div><br></div><div>Anne</div><div><br></div><div><br><div><br><div apple-content-edited="true">
<div style="orphans: auto; text-align: start; text-indent: 0px; widows: auto; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div style="orphans: auto; text-align: start; text-indent: 0px; widows: auto; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div style="color: rgb(0, 0, 0); letter-spacing: normal; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;">Anne Lyle</div><div style="color: rgb(0, 0, 0); letter-spacing: normal; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;">Ensembl Web Developer</div><div style="color: rgb(0, 0, 0); letter-spacing: normal; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;">European Bioinformatics Institute (EMBL-EBI)</div><div>East Wing, A3-118, Wellcome Trust Genome Campus, Hinxton, Cambridge, UK</div><div><br></div><div>Phone: +44 (0)1223 494178</div><div>Email: <a href="mailto:annelyle@ebi.ac.uk">annelyle@ebi.ac.uk</a></div><div style="color: rgb(0, 0, 0); letter-spacing: normal; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;">Web: <a href="http://www.ensembl.org">www.ensembl.org</a></div><div style="color: rgb(0, 0, 0); letter-spacing: normal; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><br></div></div><br class="Apple-interchange-newline"></div><br class="Apple-interchange-newline"><br class="Apple-interchange-newline">
</div>
<br><div><div>On 9 Oct 2014, at 03:53, Ben Warren <<a href="mailto:Ben.Warren@plantandfood.co.nz">Ben.Warren@plantandfood.co.nz</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div lang="EN-NZ" link="blue" vlink="purple" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><div class="WordSection1" style="page: WordSection1;"><div style="margin: 0mm 0mm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">Hi All,<o:p></o:p></div><div style="margin: 0mm 0mm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div><div style="margin: 0mm 0mm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">I am trying to host an EnsEMBL instance which will be open to public access. I have been told(by a security audit) that there is a cross-site scripting vulnerability in the EnsEMBL frontend.<o:p></o:p></div><div style="margin: 0mm 0mm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div><div style="margin: 0mm 0mm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">As far as I understand this could allow the web content to be altered by a URL with markup(HTML) code in it. Is this a risk I should be worried about? Is there some documentation regarding EnsEMBL web security which I should be reading?<o:p></o:p></div><div style="margin: 0mm 0mm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div><div style="margin: 0mm 0mm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div><div style="margin: 0mm 0mm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">Kind Regards<i><o:p></o:p></i></div><div style="margin: 0mm 0mm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div><div style="margin: 0mm 0mm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">Benjamin<o:p></o:p></div></div><table><tbody><tr><td bgcolor="#ffffff"><font><pre>The contents of this e-mail are confidential and may be subject to legal privilege.
If you are not the intended recipient you must not use, disseminate, distribute or
reproduce all or any part of this e-mail or attachments. If you have received this
e-mail in error, please notify the sender and delete all material pertaining to this
e-mail. Any opinion or views expressed in this e-mail are those of the individual
sender and may not represent those of The New Zealand Institute for Plant and
Food Research Limited.</pre></font></td></tr></tbody></table>_______________________________________________<br>Dev mailing list <a href="mailto:Dev@ensembl.org" style="color: purple; text-decoration: underline;">Dev@ensembl.org</a><br>Posting guidelines and subscribe/unsubscribe info:<span class="Apple-converted-space"> </span><a href="http://lists.ensembl.org/mailman/listinfo/dev" style="color: purple; text-decoration: underline;">http://lists.ensembl.org/mailman/listinfo/dev</a><br>Ensembl Blog:<span class="Apple-converted-space"> </span><a href="http://www.ensembl.info/" style="color: purple; text-decoration: underline;">http://www.ensembl.info/</a></div></blockquote></div><br></div></div></body></html>