Abridged XSS Prevention Cheat Sheet - Revision history

Jmanico: Redirected page to XSS (Cross Site Scripting) Prevention Cheat Sheet

2012-09-16T17:48:19Z

Redirected page to XSS (Cross Site Scripting) Prevention Cheat Sheet

Jmanico at 17:16, 16 September 2012

2012-09-16T17:16:27Z

Jmanico: /* XSS Prevention Safe Contexts */

2012-09-10T15:19:50Z

‎XSS Prevention Safe Contexts

Jmanico at 18:44, 31 July 2012

2012-07-31T18:44:08Z

Jmanico: /* Authors and Primary Editors */

2012-05-22T20:28:03Z

‎Authors and Primary Editors

Jmanico: /* Authors and Primary Editors */

2012-05-22T20:27:51Z

‎Authors and Primary Editors

Jmanico: /* Experimental Minimal Encoding Rules */

2012-05-01T08:04:33Z

‎Experimental Minimal Encoding Rules

Jmanico: /* Experimental Minimal Encoding Rules */

2012-05-01T08:04:09Z

‎Experimental Minimal Encoding Rules

Jmanico: /* Experimental Minimal Encoding Rules */

2012-05-01T08:01:00Z

‎Experimental Minimal Encoding Rules

Jmanico: /* Experimental Minimal Encoding Rules */

2012-05-01T08:00:10Z

‎Experimental Minimal Encoding Rules

← Older revision		Revision as of 17:48, 16 September 2012
Line 1:		Line 1:
−	~~= <b>Experimental</b> Minimal Encoding Rules =~~	+	#redirect [[XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet]]
−
−	~~The following examples demonstrate experimental minimal encoding rules for XSS prevention.~~
−
−	~~{\| class="wikitable nowraplinks"~~
−	\|-
−	~~! Context~~
−	~~! Code Sample~~
−	~~! Rules~~
−	\|-
−	~~\| JavaScript, quoted string in a script block~~
−	~~\| <script>alert("Hello "+"<%= <span style="color:red;">UNTRUSTED DATA</span> %>");</script>~~
−	\| <ul><li>Use these escapes: \\ \r \n \b \t \f \' \" \/</li><li>For any other character in range 0..0x19, use hex escapes</li><li>If using non-Unicode charset, any character above 0x7e, use '\u' encoding</li></ul>
−	\|-
−	~~\| JavaScript, quoted string in an event handler attribute~~
−	~~\| onclick="alert('<%= <span style="color:red;">UNTRUSTED DATA</span> %>')";~~
−	\| <ul><li>Use these escapes: \\ \r \n \b \t \f</li><li>Use hex escapes for these characters: ' " &</li><li>For any other character in range 0..0x19, use hex escapes</li><li>If using non-Unicode charset, any character above 0x7e, use '\u' encoding</li></ul>
−	\|-
−	~~\| HTML Body~~ (~~up to HTML 4.01~~):
−	~~\| <div><%= <span style="color:red;">UNTRUSTED DATA</span> %></div>~~
−	~~\| <ul><li>HTML Entity encode < &</li><li>specify charset in metatag to avoid UTF7 XSS</li></ul>~~
−	\|-
−	~~\| <b>X</b>HTML Body:~~
−	~~\| <div><%= <span style="color:red;">UNTRUSTED DATA</span> %></div>~~
−	~~\| <ul><li>HTML Entity encode < & ></li><li>limit input to charset http://www.w3.org/TR/2008/REC-xml-20081126/#charsets</li></ul>~~
−	\|-
−	\|}

@@ Line 1: / Line 1: @@
 = <b>Experimental</b> Minimal Encoding Rules =
@@ Line 162: / Line 26: @@
 |-
 |}

@@ Line 4: / Line 4: @@
 Cross site scripting is the most common web vulnerability.  Cross Site Scripting is a dangerous threat since it allows an attacker to trick a victim into executing malicious client-side script in a browser.  This cheat sheet is a derivative work of the [[XSS (Cross Site Scripting) Prevention Cheat Sheet]] and will assist web developers in eliminating XSS from their applications.
-= XSS Prevention Safe Contexts =
+= XSS Prevention Defense Rules =
 The following snippets of HTML demonstrate how to safely render untrusted data in a variety of different contexts.

← Older revision		Revision as of 18:44, 31 July 2012
Line 1:		Line 1:
		+	= DRAFT CHEAT SHEET - WORK IN PROGRESS =
	= Introduction =		= Introduction =

@@ Line 169: / Line 169: @@
 Jim Manico - jim [at] owasp.org<br/>
-Jeff Williams - jeff [at] aspectsecurity.com</br>
+Jeff Williams - jeff [at] aspectsecurity.com<br/>
 Jeff Ichnowski - jeff.ichnowski [at] gmail.com
 [[Category:Cheatsheets]]

@@ Line 136: / Line 136: @@
 = <b>Experimental</b> Minimal Encoding Rules =
-The following examples demonstrate experimental minimal encoding rules for.
+The following examples demonstrate experimental minimal encoding rules for XSS prevention.
 {| class="wikitable nowraplinks"

@@ Line 145: / Line 145: @@
 |-
 | JavaScript, quoted string in a script block
-| alert("Hello "+"&lt;%= <span style="color:red;">UNTRUSTED DATA</span> %>")
+| &lt;script>alert("Hello "+"&lt;%= <span style="color:red;">UNTRUSTED DATA</span> %>");&lt;/script>
 | <ul><li>Use these escapes: \\ \r \n \b \t \f \' \" \/</li><li>For any other character in range 0..0x19, use hex escapes</li><li>If using non-Unicode charset, any character above 0x7e, use '\u' encoding</li></ul>
 |-

@@ Line 149: / Line 149: @@
 |-
 | JavaScript, quoted string in an event handler attribute
-| example: onclick="alert('<%= <span style="color:red;">UNTRUSTED DATA</span> %>')";
+| onclick="alert('<%= <span style="color:red;">UNTRUSTED DATA</span> %>')";
 | <ul><li>Use these escapes: \\ \r \n \b \t \f</li><li>Use hex escapes for these characters: ' " &</li><li>For any other character in range 0..0x19, use hex escapes</li><li>If using non-Unicode charset, any character above 0x7e, use '\u' encoding</li></ul>
 |-