Improved: just a tiny comment change in security.properties
Make clear that it's impossible to create a complete deniedWebShellTokens
@@ -249,7 +249,7 @@ allowAllUploads=
#-- TODO.... to be continued with known webshell contents... a complete allow list is impossible anyway...
#--
#-- It could notably be improved by checking for all Javascripts payloads.
-#-- As listed at https://portswigger.net/web-security/cross-site-scripting/cheat-sheet,
+#-- But as listed at https://portswigger.net/web-security/cross-site-scripting/cheat-sheet,
#-- at 2022-02-25 there are 8929 of them considering all tags, all events and all browsers...!
#--
#-- "freemarker" should be OK, should not be used in Freemarker templates, not part of the syntax.
