view release on metacpan or  search on metacpan

doc/faq/security.html  view on Meta::CPAN

<tr valign=baseline><td><img src="monicon.png" align="bottom" alt=""></td><td>
<h3><b><a name="htmldata">Why are HTML messages a security risk?</a></b></h3>
</td></tr></table>

<p>HTML can contain dynamic content, like JavaScript.  If an
HTML message is blindly archived, you are introducing foreign dynamic
content to your web site that you have no control over.  The best
example of this danger is the problem web-based email sites (e.g.
Hotmail) encountered when malicious people were sending HTML messages
to web-based email users and the messages contained dynamic content
that would popup windows (which had a similiar style of the web-based
email hosting provider) requesting sensitive information from
users (like passwords).
</p>

<p>These types of attacks are classified as <em>Cross-Site
Scripting</em> (XSS) attacks by the security community.  The common
goal for XSS attacks is to obtain private information of a user,
like browser cookies used for site authentication.  </p>

<p>The following is a brief list of some of the security issues