Collected research

Posting raw XML cross-domain

Chris · scarybeastsecurity.blogspot.com

Sending arbitrary XML to another origin normally needs XHR, which the same-origin policy blocks. A plain form using enctype text/plain does no percent-encoding, and because XML is full of '=' characters a single name/value pair can carry a whole element, splitting at the first '='. It works on Opera, IE and Firefox; WebKit browsers still encode and convert spaces to '+'.

Record

Researcher

Chris

Published by

scarybeastsecurity.blogspot.com

Topic

Browser

In the archive

• Collected in the 2010 research round

Tags

• csrf
• sop-bypass
• content-type
• parser-differential
• http
• filter-bypass
• owasp-a01-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of Chris, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.