text:
BOSTON — Jeff Bauman stared straight ahead, his eyes wary and unconvinced, as his doctor told him the next procedure would be easy and painless. He sat in his wheelchair at Boston Medical Center, and Dr. Jeffrey Kalish, his primary surgeon, explained how a resident would remove the sutures from his legs.
Most of Bauman's legs were gone. He had been waiting for his girlfriend near the finish line of the Boston Marathon on April 15 when the first of two bombs detonated and blew them off. An iconic sporting event had turned into a scene of chilling devastation, and a photograph of Bauman in the aftermath, his legs gruesomely lost, later became a searing symbol of the attacks.
A Marathon Survivor Starts Over
20 Photos
View Slide Show ›
The day of the bombings, Bauman had had an emergency, through-knee amputation that lasted about two hours. A surgeon had sifted through layers of skin, tissue and muscle, preserving what was healthy, cutting what was dirty and sick. He had removed what was left of Bauman's lower legs at the knee joints.
Two days later, Kalish had performed a formal amputation at about four inches above the knee. He had measured the legs and cut each layer — skin, tissue, muscle and bone — farther up in the thigh, like a staircase. Then he washed out the legs for 10 minutes, tucked the muscle, and stitched the tissue.
Bauman's legs had been reduced to stumps, sewn shut across each base. Now, as Kalish spoke, Bauman pulled his left leg toward his chest and eyed the sutures.
"We literally just yank and cut," Kalish said. Bauman looked away. "Compared to everything you've been through, this is going to be a breeze. How about that?"
Kalish left the room, Bauman climbed onto a table, and the resident started on his left leg. There were 25 sutures to remove from his left and 24 from his right. The resident worked slowly, pulling and cutting, leaving the especially deep ones for Kalish to do. Bauman did not care to watch. He lay back, rested on his elbows and glanced out the window at the darkening sky and an American flag at half-staff. It had been one month since the bombings.
The resident moved on to his right leg, and on the third suture, as she pulled and cut, he cried out and grimaced and closed his eyes.
"O.K. — pain? O.K.," she said. "We'll just — we'll go from the other side."
She paused and watched his face twist.
"Do you need a break?" she asked.
"No," he said as the pain left his face and he opened his eyes. "That one hurt."
She did what she could with the right leg, and then went and retrieved Kalish. There were 10 deep ones left for him to do. He started with the left leg, and a few minutes later, Bauman whimpered again, softer now. He tried to hold back.
After this, there would be no more procedures. There was nothing more his doctors could do. His legs would be this way for the rest of his life. Learning to walk again, and whatever happened after that, was up to him.
Kalish said nothing and kept working. Bauman was crying now.
"Sorry," Kalish said, without looking up. "Almost done."
Five minutes later, he was finished, and Bauman's legs were bleeding.
"You did it," Kalish said. "I hope that wasn't so awful."
A Backpack and a Bang
Early on the morning of April 15, Bauman drove his girlfriend, Erin Hurley, to a meeting point for her charity running team.
"You better win," he said as she got out of the car. She laughed.
Bauman then napped at Hurley's apartment in Brighton, and at about 1:15 p.m. drove with her roommates, Remy Lawler and Michele Mahoney, to a marathon checkpoint in Newton. Bauman spotted Hurley there, and she ran over. The four of them group-hugged, and then Hurley took off. The plan was to meet her again at the finish line.
Bauman, Lawler and Mahoney took a cab to Boylston Street and waded through the crowd, looking for a good spot. Spectators were five and six deep. Lawler and Mahoney wormed their way closer to the street, and Bauman stayed near the back.
He was looking for Hurley when a man behind him, about five feet to his right, caught his eye. The man was wearing a dark, heavy coat, sunglasses, a backpack and a baseball cap low and tight on his head. He looked strange. Why was he dressed so warmly on a sunny day? He looked serious, too. And why was he standing so far back? Bauman looked away. He scanned for Hurley again, and then looked back over his right shoulder. The man was gone, but his backpack was there on the sidewalk.
Then Bauman saw a flash and heard a bang. Suddenly, he was lying on the sidewalk, dazed and a bit numb. He smelled sulfur. Or was it burning metal? What a firework, he thought. He sat up and saw bodies strewn and a lot of blood. Mahoney was a few feet away. She tried to scoot toward him, but her left leg would not budge. She looked at Bauman, then at his legs, and then back at him. He looked down, then back at her, horrified.
Bauman grabbed what was left of his legs, lay back down and was writhing there when Allan Panter found him. Panter, an emergency room physician from Gainesville, Ga., had been in the crowd, too, but was unharmed. He pulled Bauman from the pile of bodies and placed the loose tissue back into his leg. Bauman screamed.
Panter tied a makeshift tourniquet around his right leg, placed a jacket on him and left Bauman so he could tend to the woman sprawled nearby whose eyes were open and empty.
I'm going to die, Bauman thought, lying there alone.
He had sat up again when a man in a cowboy hat named Carlos Arredondo came bounding toward him. Arredondo had watched the chaos unfold from across the street. He called for help, and a woman came with a wheelchair. He nudged Panter, and they lifted Bauman into the chair, and off Bauman went, Arredondo running by his side.
Then the tourniquet on Bauman's right leg caught in the wheel and came undone. Arredondo tried holding the tourniquet together, but an emergency medical technician caught up to them and grabbed Bauman's right leg, applying pressure to slow the bleeding, while Bauman held his left leg up with his hands.
They made it to the medical tent, and Bauman was loaded into an ambulance headed for Boston Medical. A woman sat behind him and leaned over his face. He looked up at her and realized she was trying to talk to him. His eyes widened, and he said, "I can't hear."
She spoke louder. "Where were you on Boylston Street?" she asked.
"Up the street a little, by the grandstand," he said. He was calm. She asked what he was doing there, and he told her about Hurley. She asked how old he was, and he said 27. She asked where he was from, and he said, Chelmsford, Massachusetts.
The questions were mostly to keep him engaged and conscious. They arrived at the hospital just as the pain started to set in.
What Was Left of Him
Bauman lay asleep in a bed at Spaulding Rehabilitation Hospital in Boston as the sun peeked over the buildings across the harbor. Light filled the room, and when it came across his face, he stirred. His face was long and thin and forlorn with deep lines under his eyes and eyelashes singed so short they looked like eyeliner. He hardly slept anymore. The pain from his injuries kept him up at night, and this morning sun did not help.
It had been two weeks since the bombings, and the burns on his back were still healing. Much of the skin was bright red and a few patches were raw, and it stung if he rolled or shifted or turned the wrong way. The bedsheets also bothered his sutures. So at night, he tried to lie still, but his legs would spasm. The pain pulsated down his thighs. Sometimes, it felt as if someone were beating on his knees. Most mornings, he woke up sore.
On this morning, Hurley fetched his clothes and his toothbrush and climbed into bed with him. She had spent the night on the couch at the foot of the bed, as she spent most nights now. After a while, she kissed him goodbye and left for a run.
Bauman pulled his wheelchair alongside the bed and took the two-and-a-half-foot wooden plank from the chair's back pouch. He laid the plank from the bed to the chair, and, pushing down on it, he lifted himself slowly and scooted across into the chair. This was his new means of moving around.
Now, for a fleeting moment, he was alone.
His mind wandered. He thought of the marathon, that day. He had accepted what had happened, perhaps as much as anyone could, but he was reminded whenever he saw his legs. He could not stand to see them. He was getting better about it, but he still got shaky. And they were always so sore. Sitting there, he held them and tried to rub away the pain.
Carlyn Wells, his physical therapist, arrived for his 8 a.m. session, and they went down to the rehabilitation gym. He started his stretches, lying on his left side and lifting his right leg sideways into the air. He did this 12 times, his leg wobbling more with each lift. Then he flipped onto his right side and did the same with his left leg.
"Can you hear me well?" Wells asked. He had not answered her last question.
Bauman stopped and sat up. He rubbed his face.
"It's hard to hear in this room," he said. "It's so big."
His right eardrum was destroyed in the blast, and his left one had a sizable hole in it. He had told people it felt as if someone were holding something over his ears, only to let up every now and then. His ear doctor said he was missing about 20 decibels of hearing and that the holes were unlikely to close on their own. He recommended surgery, but Bauman refused. He had had three operations since the bombings and had decided that was his limit.
"You want me to talk louder?" Wells asked.
"Yes, please," he said.
"Will it bother you if the others turn music on?" she asked.
"The sound, it ricochets off the walls," he said, looking up. "It, like, echoes." He paused and looked back at her. "I hear it more than once. I won't be able to hear."
He finished stretching, and then worked with leg weights and a medicine ball. After 45 minutes, he was done, and Wells left him alone again in his room. He climbed back into bed and watched television. He tried to nap, but doctors and nurses kept popping in, and his thighs were sore. So he just lay there, resting. The room was starting to smell distinctly like him. He showered only a few times a week because it was such a challenge.
Later that morning, his mother, Patty, arrived. She worked as a waitress, but was given time off to attend to him. She nervously paced around the room, tidying things and reading unopened mail. She was always fretting over him, it seemed, cringing whenever he moved. Then he had to calm her down.
In the afternoon, he had occupational therapy, and his mother left. Then he climbed back into bed, rubbed his legs, picked at his eyelashes, and watched TV. More people visited. Some days, amputees from support groups came, showing off their prostheses. Sometimes, Chris Carter, the hospital psychologist, stopped in to chat.
Each Tuesday afternoon, Carter led a discussion with the marathon victims. When it was his turn, Bauman said he was optimistic, he had goals, he was trying to move on, and it could have been worse. He called the bombers cowards and clowns. He rarely thought of them, only when someone asked. He was more concerned with himself now.
His father had closely followed the manhunt. He came to see Bauman each night after work. This was by design. Bauman's mother and father had separated when he was a toddler, and they generally did not get along. So by day and night, Bauman had two sets of relatives competing for his attention. Then his friends brought food, or he played the guitar, or Hurley came over, and he felt better.
At some point, though, they had all stared at him. They expected him to be broken, angry and sad. He joked about his legs. He was trying to move on. But there was no escaping all these people, all their pity and all their questions. Then his legs were always so sore.
He never asked any of his visitors to leave, but he was a private person, and here he was confined to this bed or his wheelchair. He felt as if he were on display — hurt, tired and vulnerable for all to see. He hated the hospital for that. But he kept this all to himself.
One night, just as his patience waned, Hurley arrived; seeing her was the best part of his day now. They had been together for about a year. He had decided he wanted to marry her, buy a house with her, start a new life with her. But he sensed her guilt. She said she loved him more now. She was more affectionate. They had figured out how to be intimate in his hospital bed. She just had to be careful of his legs.
Now she kissed him and sat in the large chair next to his bed. He was lying there, his left hand behind his head. She was playing with her hair, twirling an end with her finger. She asked about his day. He wanted to talk about hers instead. She asked if she should renew the lease on her apartment. He hesitated. He tried to dissuade her, but when she resisted and made a case to keep the apartment, he suggested they buy a house together.
"It's a lot of work buying a house, you know," she said, looking down. She felt his eyes watching her. "You have to like — I don't know. It's a lot of work. It might be too much for you right now. And me, too."
She let go of her hair and scratched her nose. His eyes glossed over.
"Eventually, though," she said softly.
Painkillers and New Legs
Bauman was discharged from the rehabilitation center about four weeks after the bombings. He went back home to live with his mother in Chelmsford, and during the day, most days, it was just the two of them. Sometimes, his cousin came over to play video games. Otherwise, Bauman passed the time lying in bed until Hurley came over after work. He slept easier at home. There was not much else he could do.
Sitting in his wheelchair for a long time strained his legs. On the few occasions he did go out, he packed a zipper bag with his medication. He regularly took 1,200 milligrams of gabapentin for the phantom leg pain, 1,000 milligrams of Tylenol and 5 milligrams of oxycodone. And if the pain was still unbearable, he took more oxycodone.
He packed a baggie of painkillers the day he had his sutures removed and then again a few days later for a friend's bachelor party. It was an all-day affair at a local gun club. He had never fired a shotgun and was a bit apprehensive about it. But he learned how, and the others wheeled him out between rounds to shoot by himself, all eyes on him. He was a sideshow again. Maybe that would change when he could walk.
A few days after that, Bauman had his first appointment with the prosthetist, Paul Martino, of United Prosthetics in Dorchester. Bauman sat on the edge of a bench in a patient room and listened intently as Martino explained how his new legs would work.
To put them on, Martino said, Bauman would roll a gel liner, which resembled a skintight sock, onto his thigh, then slide his thigh into a carbon-fiber socket. He would strap the liner to the socket, and the socket would be connected to the rest of the leg.
Ottobock manufactured the legs, Martino said. It was a German company that he had trusted for years. Its Genium knees had microprocessors, he said, that would be programmed to follow Bauman's gait, to swing as he stepped, move as he moved.
Bauman nodded and rubbed his thighs. He was trying to retain it all.
He did not know what it would be like, walking on the prosthetic legs, but he hoped he would like it. He figured he would be restricted. He had made a running mental list of all the things he thought he could no longer do. He could not fly a plane, he thought, or work construction. He could not play hockey, as he used to in his father's backyard, or play sports in general. He was not sure he could ever wear pants again.
The purpose of this first visit was to make casts of Bauman's thighs to create the sockets. So first, he rolled on the gel liner; it felt strange and tight on his thighs. Then Martino put a plastic bag over it and a mesh netting over that. He took measurements, and then marked the netting and applied the plaster by dipping strips in water and setting them on.
Martino had come recommended by a doctor at Spaulding, and Bauman trusted him. He was lying on his back, watching Martino work, when Martino's assistant asked where he worked before the injury. He told her he had worked at Costco. He had started there, in the delicatessen, about two and a half years ago, while he was taking college classes. And when he left college without a degree, he had committed himself to his Costco shifts.
The assistant said she wanted to make sure his prosthetic legs would not prevent him from doing anything he was doing before. He thought for a moment and said: "I just want to get to the places I can't get in the wheelchair, you know? I want to stand up."
When Martino finished casting both thighs, he wiped down the bench, and the assistant showed Bauman an Ottobock leg. It felt solid and surprisingly heavy.
"Can you put pants on right over this?" he asked, and they assured him he could. He nodded. He was satisfied. On his way out, his mother noticed a photograph on the wall.
"Look, Jeffy!" she said. "An all-amputee hockey team!"
Face of the Tragedy
Another week passed, and Bauman started going out more in his wheelchair. His legs would still get sore, but by now, he was familiar with the pain and was bored at home. He and Hurley went out to eat, and inevitably, someone recognized him. He rarely paid for a meal anymore. Chefs and managers offered him gifts. They had seen the marathon-day photograph, published around the world, of Arredondo wheeling him away, his legs shredded.
Bauman could not bear to see the photo now. But it resonated with people in Boston. It was shown on the scoreboard at Fenway Park when the Red Sox had Bauman and Arredondo throw out ceremonial first pitches together. The crowd roared as they took the field. One man asked Bauman for an autograph. "You're an inspiration," the man said.
Bauman had recently asked his mother why people so adored him. They respected his bravery, she had said, and he was the face of the tragedy, of those who survived.
The day after the Red Sox game, Bauman and Hurley were invited to attend James Taylor's rehearsal as he prepared to perform at a concert to benefit the marathon victims. After the set, Taylor sat with them.
"So, you're a guitar player, I hear," he said, tapping Bauman's forearm.
"Yeah, I can play a couple of chords," Bauman said. His ears were still ringing from the music, but he did not mention this, or how he played the guitar for only five minutes at a time now, his ears frustrated him so.
They chatted about Bauman's first pitch at Fenway, about his rehabilitation, and the future. Bauman had to learn to walk first, and after that, he did not know what to expect. Taylor was asking questions Bauman had to ask himself.
Taylor asked about Costco and whether Bauman would return to work there. Bauman said yes, he would, once he was strong enough. But he had worried about having to stand all day. He had thought, maybe instead, he could do something that helped people.
Then Taylor asked about his health insurance at Costco and if it was covering his expenses, and Bauman said yes. But he did not know entirely. He had not seen a bill from Boston Medical or Spaulding. His new legs cost about $100,000 each, but he expected them to be covered by his insurance and a foundation called Wiggle Your Toes.
"You probably get a lot of donations, too, huh?" Taylor said.
"Yeah, I get a lot of donations," Bauman said. "It's a lot. I'm getting money all the time."
An online fund-raiser for him had reached nearly $800,000, and he would soon receive a $2.2 million check from the One Fund, which was established to benefit the marathon victims.
But he feared his money and fame would run out. He retained a lawyer and two financial advisers. He put his money in a trust fund. He would trade it all, though, just to have his legs back.
But he tried not to think like that.
"Yeah, I guess I'm going to need it," Bauman told Taylor. "I guess this stuff's expensive."
"You should sit back and let people do what they can," Taylor said, "because it makes people feel good — like they're doing something."
Bauman nodded and stared at the ground.
The First Steps
The day after the concert, Bauman was going to try to walk. His prosthetic legs had been made, and now the thigh sockets needed to be fitted. At his last appointment at United Prosthetics, he had taken a few short steps, but Martino had held his hips. Martino wanted him to walk on his own now, to see how everything felt and if any more adjustments were necessary.
Bauman's mother, his girlfriend and a few others gathered to watch in a hallway narrow enough that Bauman could reach the railings on each wall. He was in his wheelchair as he rolled the gel liners onto his thighs. He held his left thigh and squeezed it.
Martino held the legs in place as Bauman pulled on the sockets. He strapped the liners to the sockets as Martino adjusted the knees and set the feet on the ground, with their black, size-10 ½ sneakers. Bauman scooted forward in the chair, grabbed the railings and pushed himself up. Martino had a hold of him and helped him stand all the way up.
Hurley was behind him, and she, like the others, watched quietly. Bauman pursed his lips as he balanced using the railings and straightened himself over the legs. The chair was pulled out from behind him, and Martino crouched down to examine the sockets.
The first time Bauman had stood, the top had pinched his skin and the bottom had hurt the ends of his thighs. But Martino had corrected the sockets, and everything felt fine now. Bauman's legs were sore, as they always were, but the pain no longer deterred him.
A Marathon Survivor Starts Over
20 Photos
View Slide Show ›
He seemed at ease with his torso leaning forward and supported mostly by his hands on the railings, as Martino worked. Then Bauman let up on the railings, stood up straighter, and felt the pressure on his thighs, the ground firm underneath him. He felt in control.
"All right, you O.K. to stand on that?" Martino said. "I'm going to run for a wrench."
Martino left the room, and Bauman arced his neck back toward Hurley.
"How you doing, honey?" she asked.
"Good," he said. He was completely upright now. He looked sturdy.
He turned forward and watched himself in the mirror at the end of the hallway. He lifted his hands off the railings, wobbled a bit and put his hands back. Hurley had not seen him do it. He did it again, lifting his hands higher now, and grinning.
"No!" Hurley said. "Be careful!"
She wrapped her arms around him and kissed the back of his neck.
"Be careful," she said softly. "You're making me nervous."
She leaned against the wall, keeping hold of his midsection.
She looked down at his legs. "Does it hurt?" she whispered.
"No," he said. "I feel tremendously balanced."
Martino returned, and Hurley moved away and left Bauman standing there by himself. Martino examined the legs, then stepped back and asked Bauman to walk.
Bauman leaned on the railings, hunched over, and swung his left foot ahead, barely off the ground. His face strained.
He took five steps, each a bit more cautious than the last.


text:
Internet Marketing Services
In this current competitive economy, all types of businesses have been impacted due to huge number of competitors who offers similar services as yours. It becomes imperative to increase your company visibility online.
Through the use of internet our digital and internet marketing specialists will market your business/services or products online to every person in the world that have an internet connection.
Online marketing, digital marketing, e-commerce and internet marketing is very competitive and your urgent response is needed to establish your web position. We being the leaders in internet marketing industry understand your needs and we ensure you to be the top in your services.Our Internet Marketing services include:
Search Engine Optimization: Professional seo services to maintain your website on the high search engine rankings for both organic and paid search
Link Building: Increase your link popularity by securing more quality links.
Keyword Research: Top keywords related to your site/product for high search engine positioning
SEO Copywriting: Make your website search engine friendly, drive more traffic and attract more customers to your website by using our professional seo Copywriting services
Pay Per Click: Bid for words, pay per click and advertise your site in the search engines to ensure high search engine placement
Contextual Advertising: Draw a lot of specific visitors to your websites who are researching on the related product or service.
Affiliate Marketing: Increase your sales and revenues by focusing on targeted visitors
Competitor Analysis: Know your competitor online strength and weakness and develop suitable strategy
Behavioral Targeting: Know your audience, target new and existing customers and increase sales conversionsEmail Marketing: Increase your direct sales by using our email marketing services
Social Network Know your brand audience online in the social networking web sites and see the challenges ahead
eBay Store Management: Manages the whole eBay life cycle right from purchase and selling of your stock from channels of your choice
Blog Marketing:Banner Advertising: An effective way to get your advertising message on the internet and promote your business online

subset: commoncrawl


text:
This Ravel ladies' AW19 burgundy pump with a buckle decoration adds definition and edge to a classic design. Along with the pointed toe, the Lincoln shoe features a moc croc finish and a 9cm heel so you can be sure that this piece will elevate your look to super elegant status. Pair it with a knee-length skirt and jacket for a smart business look. Lincoln is also available in black.
Payment can be made using the following major credit and debit cards: Visa, Visa Debit, Visa Electron, Mastercard, Maestro. We also accept payment through PayPal.
Returns Information for Christmas 2019.
Items that are purchased from Friday 29th November 2019 can be returned to us anytime upto 15th January 2019 for either a replacement size or a full refund.
Delivery Information.
Orders are processed and delivered Monday-Friday (excluding UK holidays), we do not despatch or deliver on weekends. Orders placed after 5pm (GMT) will be processed the following working day. Unfortunately we can not be held responsible for deliveries that are late.
UK Orders
We offer standard delivery with a rate of £2.95 and next day delivery with a rate of £3.95.
International Orders
A single order can include up to 10 items for which the shipping prices are fixed. Delivery times are a guide only and are representative of the costs we incur. Please note that prices quoted include UK VAT only (which is payable on all orders), some international deliveries may be subject to local duty and custom charges for which you, the customer, are responsible.
Returns Policy
We now offer FREE UK returns. Please see http://www.ravel.co.uk/delivery-returns-i5 for more information.
For international orders, customers are liable for any charges in relation to returning any unwanted items unless the item is faulty. From the date you received your order, you have 14 days to return unworn purchases. Items must be returned unused and in their original packaging or we will not be able to accept the item.


text:
We support both claimants and professionals. These are just some of the organisations who have subscribed to Benefits and Work:
Royal College of Nursing | Birmingham CAB
Spinal Injuries Association | Coventry Mind
Chesterfield Law Centre | Colchester Borough Council
Disability Living Allowance (DLA)
Important! From 10th June 2013, it is no longer possible for adults aged 16 or over to make a fresh claim for disability living allowance (DLA). Instead, you will need to make a claim for personal independence payment (PIP).
In some areas of the country claimants who are making a renewal claim for disability living allowance will also have to make a claim for PIP instead of DLA.
This change should have affected the whole country at once. But, because of problems and backlogs in the PIP assessment system from the very outset, the introduction of PIP is being phased in much more gradually than was originally intended.
You can find out more about the timetable for the roll-out of PIP here.
At the moment, the DWP's intention is that claimants who have 'lifetime' or 'indefinite' awards of disability living allowance will start being reassessed from October 2015, although this deadline may slip as well.
In the meantime, if your DLA award was a time limited one and you have been sent a disability living allowance renewal claim pack rather than personal independence payment claim pack, then our DLA guides are still the most effective tools for improving your chances of getting the right award on renewal.
Find out more about our guides to:
In addition, disability living allowance claims for children under 16 are not afffected by the introduction of PIP. We publish detailed guides to claiming DLA for children in the members area of the site.


text:
The guide to Sheffield'sradical, alternative, ethicalbusiness and groups
Tue 14 Oct 2014, 8pm Red Lion, Charles St (Hubs end) S1 2ND
Monthly meeting of Greenpeace's active South Yorkshire group, held on the 2nd Tuesday of each month. Newcomers always welcome. More details of meetings and current activities in the Get Active supporters' newsletter and Facebook page. Greenpeace South Yorkshire
Promote Alt Sheff
Alt Sheff on Facebook
RSS Feeds


text:
This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
DOM based XSS Prevention Cheat Sheet
- 1 Introduction
- 2 HTML Sub Context within the Execution Context
- 3 HTML Attribute Sub Context within the Execution Context
- 4 URL Attribute Sub Context within the Execution Context
- 5 CSS Attribute Sub Context within the Execution Context
- 6 Event Handler and JavaScript code Sub Contexts within an Execution Context
- 7 Guidelines for Developing Secure Applications Utilizing JavaScript
When looking at XSS (Cross Site Scripting) there are three generally recognized forms of XSS. Reflected, Persisted, and DOM based XSS. The XSS Prevention Cheatsheet has done an excellent job of addressing Reflected and Persisted XSS. This cheatsheet will address DOM (Document Object Model) based XSS and is an extension (as assumes comprehension of) the the XSS Prevention Cheatsheet .
In order to understand DOM based XSS one needs to see the fundamental difference between reflected and persisted XSS when compared to DOM based XSS. Reflected and persisted XSS exist in a higher level rendering context and DOM based XSS is primarily found in a lower level execution context. A rendering context is associated with the parsing of HTML tags and their attributes. The HTML parser of the rendering context dictates how data is presented and laid out on the page and can be further broken down into the standard contexts of HTML, HTML attribute, URL, and CSS. The JavaScript or VBScript parser of an execution context is associated with the parsing and execution of script code. Each parser has distinct and separate semantics in the way they can possibly execute script code (XSS) which make creating consistent rules for mitigating both rendering and execution based contexts difficult. The complication is compounded by the differing meanings and treatment of encoded values within each sub context (HTML, HTML attribute, URL, and CSS) within the execution context.
This paper refers to the HTML, HTML attribute, URL, and CSS Cheatsheet contexts as subcontexts because each of these contexts can be reached and set within a JavaScript execution context. In JavaScript code the main context is JavaScript but since an attacker can try to attack the other 4 contexts using equivalent JavaScript DOM methods we refer to the other contexts besides the JavaScript context as sub contexts.
The following example of an attack which occurs in the JavaScript context and HTML sub context:
var x = '<%= htmlAndJavaScriptEncodedVar %>';
var d = document.createElement('div');
d.innerHTML = x;
HTML Sub Context within the Execution Context
There are several methods and attributes which can be used to directly render HTML content within JavaScript. These methods constitute the HTML Sub Context within the Execution Context.
element.innerHTML = " Tags and markup";
element.outerHTML = " Tags and markup";
document.write(" Tags and markup");
document.writeln(" Tags and markup");
In a pure HTML execution context (not HTML Attribute) use HTML and JavaScript encoding to mitigate against attacks.
element.innerHTML = "<%=Encoder.encodeForJS(Encoder.encodeForHTML(untrustedData))%>";
element.outerHTML = "<%=Encoder.encodeForJS(Encoder.encodeForHTML(untrustedData))%>";
HTML Attribute Sub Context within the Execution Context
The HTML attribute Sub Context within the Execution context is divergent from the standard encoding rules. This is because the rule to HTML attribute encode in an HTML attribute rendering context is mitigating attacks which try to exit out of the attribute to add additional attributes and/or tags which could have executable code. When you are in a DOM execution context you only need to JavaScript encode HTML attributes which do not execute code (attributes other than event handler, CSS, and URL attributes).
For example, the general rule is to HTML Attribute encode untrusted data (data from the database, http request, user, backend system, etc.) placed in an HTML Attribute. This is the appropriate step to take when outputting data in a rendering context, however using HTML Attribute encoding in an execution context will break the application display of data.
var x = document.createElement("input");
x.setAttribute("name", "company_name");
x.setAttribute("value", '<%=Encoder.encodeForJS(Encoder.encodeForHTMLAttr(companyName))%>');
var form1 = document.forms[0];
The problem is that if companyName had the value "Johnson & Johnson". What would be displayed in the input text field would be "Johnson & Johnson". The appropriate encoding to use in the above case would be only JavaScript encoding to disallow an attacker from closing out the single quotes and in-lining code.
var x = document.createElement("input");
x.setAttribute("name", "company_name");
x.setAttribute("value", '<%=Encoder.encodeForJS(companyName)%>');
var form1 = document.forms[0];
It is important to note that when setting an HTML attribute which does not execute code the value is set directly within the object attribute of the HTML element so there is no concerns with injecting up.
URL Attribute Sub Context within the Execution Context
The logic which parses URLs in both execution and rendering contexts looks to be the same. Therefore there is little change in the encoding rules for URL attributes in an execution (DOM) context.
var x = document.createElement("a");
x.setAttribute("href", '<%=Encoder.encodeForJS(Encoder.encodeForURL(companyName))%>');
var y = document.createTextElement("Click Me To Test");
If you utilize fully qualified URLs then this will break the links as the colon in the protocol identifier ("http:" or "javascript:") will be URL encoded preventing the "http" and "javascript" protocols from being invoked.
CSS Attribute Sub Context within the Execution Context
document.body.style.backgroundImage = "url(<%=Encoder.encodeForJS(Encoder.encodeForURL(companyName))%>)";
TODO: We have not been able to get the expression() function working from DOM JavaScript code. Need some help.
Event Handler and JavaScript code Sub Contexts within an Execution Context
Putting dynamic data within JavaScript code is especially dangerous because JavaScript encoding has different semantics for JavaScript encoded data when compared to other encodings. In many cases, JavaScript encoding does not stop attacks within an execution context. For example, a JavaScript encoded string will execute even though it is JavaScript encoded.
var x = document.createElement("a");
x.setAttribute("onclick", "\u0061\u006c\u0065\u0072\u0074\u0028\u0032\u0032\u0029");
var y = document.createTextNode("Click To Test");
JavaScript event handler methods are dangerous because they implicitly do an eval() on the data passed to the DOM attribute. There are other places in JavaScript where JavaScript encoding is accepted as valid executable code.
for ( var \u0062=0; \u0062 < 10; \u0062++){
.\u0065\u0076\u0061\u006c (
var s = "\u0065\u0076\u0061\u006c";
var t = "\u0061\u006c\u0065\u0072\u0074\u0028\u0031\u0031\u0029";
However the opposite is the case with HTML encoding.
HTML Encoding's Disarming Nature
In general, HTML encoding servers to castrate HTML tags which are placed in HTML and HTML attribute contexts. Working example:

Normally encoded example (Does Not Work – DNW):

HTML encoded example to highlight a fundamental difference with JavaScript encoded values (DNW):

Guidelines for Developing Secure Applications Utilizing JavaScript
- Data should only be displayed as displayable text. Never treat untrusted data as code or markup within JavaScript code.
- Always JavaScript encode and delimit untrusted data as quoted strings when entering the application (Jim Manico and Robert Hansen)
var x = "<%=encodedJavaScriptData%>";
setTimeout("customFunction('<%=doubleJavaScriptEncodedData%>', y)");
- Use document.createElement("…"), element.setAttribute("…","value"), element.appendChild(…), etc. to build dynamic interfaces. Avoid use of HTML rendering methods:
element.innerHTML = "…";
element.outerHTML = "…";
- Understand the dataflow of untrusted data through your JavaScript code. If you do have to use the methods above remember to HTML and them JavaScript encode the untrusted data (Stefano Di Paola).
- There are numerous methods which implicitly eval() data passed to it. Make sure that any untrusted data passed to these methods is delimited with string delimiters, double JavaScript encoded, and wrapped in a custom function. Ensure to follow step 4 above to make sure that the untrusted data is not sent to dangerous methods within the custom function.
setTimeout("customFunction('<%=doubleJavaScriptEncodedData%>', y)");
- Limit the usage of dynamic untrusted data to right side operations. And be aware of data which may be passed to the application which look like code (eg. "location", "eval"). (Achim)#
var x = "<%=properly encoded data for flow%>";
if you want to change different object attributes based on user input instead of:
window[userData] = "moreUserData";
- Use the following methods when placing dynamic untrusted data in right side operations.
if (userData==="location") {
window.location = "static/path/or/properly/url/encoded/value";
- When URL encoding in DOM be aware of character set issues as the character set in JavaScript DOM is not clearly defined (Mike from Google).
- Limit access to properties objects when using object[x] accessors. (Mike from Google). In other words use a level of indirection between untrusted input and specified object properties.
- Run your JavaScript in a ECAM5 canopy or sand box to make it harder for your JavaScript API to be compromised (Gaz Hayzes and John Stevens).
- Don't eval() JSON to convert it to native JavaScript objects. Instead use JSON.toJSON() and JSON.parse() (Chris Schmidt).
Special thanks to Jim Manico, Gareth Heyes, Stefano Di Paola, Robert Hansen, Mario Heiderich, Achim Hoffmann, John Stevens, Edwardo (SirDarkCat) Alberto Vela Nava, Chris Schmidt, Mike Samuel, Jeremy Long, Jeff Williams, and many others who help make this guide possible
OWASP Cheat Sheets Project Homepage


text:
Even the characters inside of video games are sick of the wub-wub.
Listen to Vaas—the insane pirate at the center of open-world first-person-shooter Far Cry 3—bitch about the bass-heavy tracks that pop up in damn near every big-budget video game trailer. Yes, he's naked some of the time but don't let his total nudity distract you from the truth of his words. "All these f***ing games playing the exact same f***ing beats…" Preach it, Vaas.
(Thanks, tipster Tim!)


text:
Your Account
For Inquiries Contact
Press Inquiries
Find Other Authors
Experienced Security Practioner
Cupertino, California
Cloud Security and Privacy
by Tim Mather, Subra Kumaraswamy, Shahed Latif
September 2009
Print: $34.99
Ebook: $27.99
Webcast - Cloud Security Deep Dive
January 20, 2010
In this 90 minute webcast, the three coauthors of Cloud Security and Privacy (recently published by O'Reilly) will take a deep dive into cloud security issues and focus on three specific aspects: (1) data security; (2) identity management in the cloud...
Webcast - Cloud Security & Privacy
January 20, 2010
This 75-minute webcast will discuss current issues in cloud computing with regard to security and privacy. The presenters are the three coauthors of a recently published O'Reilly book, Cloud Security and Privacy. In this webcast, they will discuss cloud...
Webcast: Cloud Security & Privacy
September 24, 2009
In this webcast, the authors of Cloud Security and Privacy will discuss cloud computing's SPI delivery model.
"This book can be a good resource for people who are planning on cloud computing solutions. "
--Andy Zhang, Amazon.com
"The authors successfully manage to provide a very helpful overview of the topic...the book will help readers understand cloud security concepts and ideas, as well as expectations for the future.
--Kate Barr, Computing Reviews
"Overall this is a surprisingly good book tackling a difficult topic..."
--Sue Gee, I Programmer
"The book is indeed a comprehensive treatise on everything cloud, and everything cloud security...One of the most important things I picked from the book was a very structured view on separation of security responsibilities between the cloud provider and the customer for all of the SPI scenarios. This alone probably justifies getting your own copy. "
--Dr. Anton Chuvakin, Amazon.com
"...this is a great source of information on a very hot topic du-jour, and the combined experience and expertise of the authors does a lot to bring credibility and added value to this work. It is highly recommended for those that are either currently using, or considering, cloud services for their enterprise in the immediate or very near future."
--Jude Umeh, FBCS, CITP, BCS
"There are no other books that I know of that attempt to deal with this subject as completely and as comprehensively as does Cloud Security and Privacy. You really do owe it to your organization to read this first in order to be able to ask the right questions. Anything less would be highly negligent on your part. "
--Thomas Duff, Duffbert's Random Musings
© 2020, O'Reilly Media, Inc.
(707) 827-7019
(800) 889-8969
All trademarks and registered trademarks appearing on oreilly.com are the property of their respective owners.


text:
There is a bug in ZCS where the mailbox server may delete data that contains information about user mailboxes. This information includes folder names, a list of messages stored in those folders, contacts, user-defined tags, and more. This behavior occurs under certain, unlikely error conditions, but if encountered the users will be unable to login and a full restore of the impacted mailboxes will be required. To prevent any possible data loss on your system we recommend that you follow the steps below to patch all mailbox stores in your system as soon as possible.
II. Impact
ZCS 4.5.0 and greater are affected. ZCS 4.0.x and 3.1.x are not affected.
We have discovered a lack of robustness in our code to handle MySQL error conditions. Under certain combinations of conditions, such as errors in connectivity to the database during mailbox creation, a Zimbra server can drop mailbox group databases. Mailbox group databases store the metadata for a set of user mailboxes. Metadata includes user folder names, a list of messages in those folders, contacts, user-defined tags, and most other information about the mailbox that is not in the actual messages. The loss of the mailbox group database will prevent logins for all users that were in the mailbox group database. On average a mailbox group database has 1% of the users on a server. This error can happen repeatedly, impacting a different mailbox group database with each occurrence.
Details of this bug can be found in
color='Red'>This bug presents a risk of causing critical data loss. Any mailboxes affected by this bug will have to be restored from backups.
ZCS 4.5.6 will include the fix for this issue.
III. Solution
This can be done on a live server without taking the server offline. We recommend that all Zimbra administrators perform the following workaround immediately by editing the file:
and *REMOVE* the following line of SQL code (it should be just below the license preamble text) in that file:
DROP DATABASE IF EXISTS ${DATABASE_NAME};This should be done on all servers with a mailbox store. This file is re-read each time a mailbox is created, and therefore can be edited without a server restart. We recommend the follow sequence of steps if you choose to edit the file while the server is running
(commands should be executed as the 'zimbra' Unix user):
(commands should be executed as the 'root' Unix user):
cd /opt/zimbra/db
cp create_database.sql create_database.sql.orig
cp create_database.sql create_database.sql.edit
* edit (vi, emacs etc) create_database.sql.edit to remove line *
mv create_database.sql.edit create_database.sqlThe Unix mv command is atomic, and if you follow the above steps, the server will not see an inconsistent copy of this script.
Network Edition Customers: If you have any questions or would like assistance please contact Zimbra Support via the Support Portal.
Open Source Users: If you have any questions, please confine them to the thread in the administrators forum. You can also private message jholder, KevinH, or Phoenix with any private questions or comments.


text:
Tech Update
Protecting Coated Coils
The two packaging options are eye to the sky and horizontal eye. Eye-to-the-sky coils are transported on a pallet, so size and weight limitations must be considered. The coil cannot be larger or heavier than the pallet or handling equipment will allow. This type is helpful in preventing damage to coil sidewalls during in-plant transport. Horizontal-eye orientation may be necessary for transporting coils with larger exterior diameter. Measures must be taken to prevent rolling or other unwanted movement and denting.Several methods help prevent movement during shipping. Belly and eye banding may be used individually or together. Belly banding wraps around the outside of the coil and helps prevent it from unraveling. Eye banding uses multiple bands that intersect the exterior and exterior circumference of the coil. Eye banding prevents unraveling and telescoping.
Tape works well for situations where low banding strength is allowed. Steel or aluminum strapping provides maximum strength with simple disposal. Tape offers simple disposal and minimum thickness. Plastic strapping delivers medium strength and is slightly harder to dispose of.
Wrapping coils or using tarps will add further protection. Most plants use a forklift with padding on the forks and mast for in-plant transport. Good handling practices are desirable for best results in processing.
• Storage in weatherproof buildings is preferable; otherwise, keep the material clean and free of condensation.
• Avoid damage to coil edges.
• Handling devices should have padding.
The value of prefinished metal coils makes proper protection important. Various cushioning materials can protect coils while they are moved. Polyurethane is one of the most effective materials, but felt as well as previously used conveyor belting also work well. To protect coils stored in inventory, use floor pads made of polyurethane or an equivalent cushioning material. Protective films may be applied at slitting or sheeting if required.
Coils often are lifted from turnstiles with a V-shaped coil car. The surface of that coil car should be made of a nonmetallic material. Turnstiles with modular round supports made of hardened steel for coil support help reduce damage.
To prevent damage during handling: do not sit coils on band-securing clips; try to limit the number of bands used, as each band increases the risk of denting; stocked coils should remain banded until processed; be careful when removing bands to prevent snapback of the coil; and keep the clips off of the coil surface.
National Coil Coating Association: 216/241-7333; www.coilcoatinginstitute.org
See also: National Coil Coating Association
Related Enterprise Zones: Coil Handling, Materials/Coatings


text:
You may recall my comments on that article about the sexism panel at NASW. It was an oddly glib summary of the panel that gave cursory attention to the women's statements, and spent most of its time discussing the reactions of men in the audience — it was a sad example of how even women will prioritize men's voices. Emily Willingham gave it an even more thorough and scathing review.
Tabitha Powledge and Beryl Benderly, the authors of the original review, then fired back at Willingham. It was a terrible angry reply: Powledge and Benderly basically belittled Willingham for being too young to understand, and ranted about having been Second Wave Feminists who created the environment that allowed Willingham to be employed…and they also literally called what Willingham had written to be a "cat fight". It was ugly. Real ugly.
You can't read it, though. The post was taken down by the PLoS Blogs community manager, although the comments are still left intact.
PLOS BLOGS has determined that the "On Science Blogs" post that had occupied this page violated one of the key principles we hold for our blog network, specifically, the following language which is included in our independent blogger contract: PLOS is interested in hosting civilized commentary and debate on matters of scientific interest. Blogger will refrain from name calling and engaging in inflammatory rhetoric.
Because, after careful review, we've determined that this post crossed the line delineated in this tenet, we're taking the post down. We've left the comments intact.
We're sorry for any distress that the content of this post caused to the target, Emily Willingham, and hope that discussion and debate can continue on the original and vitally important topic of sexual harassment without resorting to this level of exchange.
Yikes. While the post may have been hideous, I don't like the idea that it could be deleted like that. Leave it up, close comments, make a statement that it was not acceptable, but erasing it is something I find even more offensive.
Willingham has updated her post with this comment:
The two people involved in the post I critique below, Tabitha Powledge and Beryl Benderly, NASW board members, have posted their comments about my critique here. I will let their two responses speak for themselves and just reassert that the original post was an example of the problem in having foregrounded men in every aspect, from text word counts to links included to who was named and quoted to art to tags to "the most powerful and significant statements came from men," and that the tone of "back to our regular program" was inappropriate. Further, I add that because I was commenting on a high-profile summary of a very high-profile and edgy situation that is critical to our community, one written by a board member of NASW and featured on the site of another NASW board member, I also vetted my commentary with half a dozen relevant people before posting it. As for a formal post about the NASW panel from the panelists themselves, of which I was one, we await availability of the video recording of the proceedings so that the overview will be complete.
Right — it's a "high-profile and edgy situation", so I'd rather see that both sides of the argument were left visible.


text:
Kevin Love scored 31 points to lead the Minnesota Timberwolves over the Chicago Bulls 95-86 Monday night.
Ronny Turiaf added 14 points off the bench for the Timberwolves, who snapped a seven-game losing streak to the Bulls and won for the fourth time in five games overall.
Carlos Boozer had 20 points and 14 rebounds for the Bulls, who played without ailing center Joakim Noah (illness) and guard Kirk Hinrich (hamstring). D.J. Augustin added 19 points.
The Timberwolves were also missing their starting center. Nikola Pekovic exited with a sore right Achilles tendon midway through the first quarter. He had one point and one rebound.
The Bulls pulled within five with 1:29 left on Augustin's 3-pointer but got no closer. Love answered with a layup with 1:10 remaining, and Corey Brewer's dunk gave the Timberwolves an 88-79 lead with 57.4 seconds left.


text:
As the Anthropocene Era unfolds, I keep learning of weather phenomena we'd rather not experience. First it was a haboob over Phoenix.
Now we have a Derecho taking six times as many lives as the Waldo Canyon fire raging out west. *Bam!* *Pow!* (That's the one/two punch we got on Saturday in the US.)
Derecho: Behind Washington, D.C.'s destructive thunderstorm outbrea...
A "fast-moving, long-lived, large, and violent thunderstorm complex" fueled by a heat wave and jet stream.
During summer, the jet stream atop a sprawling heat dome is sometimes called a "ring of fire" due to the tendency for explosive thunderstorms to form along this weather front separating hot, humid air to the south and cooler, drier air to the north.
As the intensity of the heat wave, without reservation, was a key factor in the destructiveness of this derecho event - it raises the question about the possible role of manmade climate warming (from elevated greenhouse concentrations).
Views: 965
When I first saw the story about the Haboob over Phoenix, all I could think of was, "I wonder how hard it will be to get that mess out of the vents???" That's crazy stuff.
We've had our madness here in recent years too, those super-cell, long-track tornadoes spawned last year that flattened our Lowes Home Improvement and wreaked havoc on tens of thousands of homes, now this year, record breaking heat waves. It has been an interesting weekend what with losses of power and DSL outages we had downburst winds drop an oak on our power line right of way behind the house this morning...interesting.... You're told of events like the tornadoes of last year, 'this happens' historically, I need to look into that claim, I can't find anyone that remembers an outbreak of tornadoes the likes of which the southeast and midwest faced last year. I can find evidences of long-tracks but on the damaging scale that we saw last year?
The long track supercells spawning multiple tornadoes do seem to be more in the news the last several years, more than I ever remember in previous times. Like Joplin just being wiped out and the February storm in Oklahoma, West Virginia, Missouri, and Kentucky. 1000-Mile Supercell Drops Multiple Tornadoes
Nobody has come up with a foreign catchy name for that weather phenomenon, but it's in the same class of welcome-to-the-next-level weather phenomena as far as I'm concerned. I agree We're seeing destructive weather on a new scale.
Emotionally it's surreal, as if reality has blended with disaster movies.
I remember many tornadoes prior to those last year and I know how wishy washy this may sound, but walking around surveying the damages and helping out after those storms, one got the feeling that we'd never seen that kind of destructive force before, there was something so Stephen King, Dean Koontz about the whole scene.
It's nice to see I'm not the only one that found them surreal, you get to feeling awfully alone down here in Gawds Will country, when no one seems to see, what to me seems very obvious, large scale changes in weather patterns, that signal we're doing something very wrong to cause the super heating and cooling that causes these modern day monsters.
Speaking of disaster movies, Bill McKibben has a cute piece Bill McKibben on the Global Warming Hoax claiming these events are just a hoax and we're just enjoying a disaster movie.
Now that was great! I'm going to have to share this with my anti-warming cousin who is just convinced that progessives have created the science to make more money on 'green' products!
Here's a YouTube bit that strikes me as "ha ha only serious" (hot weather with a chance of Godzilla in Richmond this weekend?) :
Haboobs and Derechos? Where in the heck did they get those names?
Haboob comes from Arabic. "a violent dust storm or sandstorm especially of Sudan"
Derecho comes from Spanish for straight line. We found it in Wikipedia.
The derecho "had energy readings five times that of normal thunderstorms." The body count of "the storm and its aftermath" is now 20.
Summer 'what global warming looks like'
Wow... and yet we have people that still call us global warming conspiracy theorists/soothsayers and accuse us of fabricating evidence to make money off of 'green products'...
© 2020 Atheist Nexus. All rights reserved. Admin: The Nexus Group. Powered by


text:
Yue Jin wrote:Mistro,Have you played the Drakengard games by Square-Enix?.I believe that both games were good,That you should try(If you haven't already).It's a mix of Dynasty Warriors and Panzer dragoon .
What can KOEI really do? Their hands are a bit tied by it being based on the ROTK book.Ranbir wrote:I can not find any other game series that is simply giving you the exact same story you experienced in the game before, nor in such frequency.
Question: How much more satisfying would you have found the series if say:
DW2 provided an indepth, detailed musou mode covering the Yellow Turban Rebellion.
DW3 provided an indepth, detailed musou mode covering the coalition against Dong and the antics of Lu Bu
DW4 provided an indepth, detailed musou mode covering Cao Cao's rise to power and Liu Bei doing stuff
DW5 provided an indepth, detailed musou mode covering whatever happened after that, blah blah.
And so forth?
Proper sequels, we're actually getting to enjoy moving forward in the story, better sense in the process of introducing new characters and less fatigue in the gameplay itself(that hasn't changed much until Renbu) rather than having ourselves reboot all in the name of a few cosmetic changes.
Return to Dynasty Warriors Training
Users browsing this forum: No registered users and 1 guest
Copyright © 2002–2008 Kongming's Archives. All Rights Reserved