CRV2 ContextEncHTMLEntity - Revision history

EoinKeary at 15:47, 3 October 2013

2013-10-03T15:47:22Z

EoinKeary at 15:46, 3 October 2013

2013-10-03T15:46:01Z

EoinKeary at 15:43, 3 October 2013

2013-10-03T15:43:34Z

EoinKeary at 15:43, 3 October 2013

2013-10-03T15:43:05Z

EoinKeary at 15:40, 3 October 2013

2013-10-03T15:40:02Z

EoinKeary at 15:37, 3 October 2013

2013-10-03T15:37:43Z

EoinKeary at 15:37, 3 October 2013

2013-10-03T15:37:10Z

EoinKeary: Created page with "HTML elements which contain user controlled data or data from untrusted sourced should be reviewed for contextual output encoding. In the case of HTML entities we need to help..."

2013-10-03T15:27:02Z

Created page with "HTML elements which contain user controlled data or data from untrusted sourced should be reviewed for contextual output encoding. In the case of HTML entities we need to help..."

New page

HTML elements which contain user controlled data or data from untrusted sourced should be reviewed for contextual output encoding.
In the case of HTML entities we need to help ensure HTML Entity Encoding is perfromed:

'''Example HTML Entity containing untrusted data:'''
HTML Body Context
<span>UNTRUSTED DATA</span>

← Older revision		Revision as of 15:47, 3 October 2013
Line 33:		Line 33:
	'''PHP'''<br>		'''PHP'''<br>
	[http://php.net/manual/en/function.htmlentities.php http://php.net/manual/en/function.htmlentities.php]		[http://php.net/manual/en/function.htmlentities.php http://php.net/manual/en/function.htmlentities.php]
		+
		+	'''.NET'''<br>
		+	[http://msdn.microsoft.com/en-us/library/w3te6wfz.aspx http://msdn.microsoft.com/en-us/library/w3te6wfz.aspx]

← Older revision		Revision as of 15:46, 3 October 2013
Line 29:		Line 29:
	[http://code.google.com/p/owasp-esapi-java/source/browse/trunk/src/main/java/org/owasp/esapi/codecs/HTMLEntityCodec.java http://code.google.com/p/owasp-esapi-java/source/browse/trunk/src/main/java/org/owasp/esapi/codecs/HTMLEntityCodec.java]		[http://code.google.com/p/owasp-esapi-java/source/browse/trunk/src/main/java/org/owasp/esapi/codecs/HTMLEntityCodec.java http://code.google.com/p/owasp-esapi-java/source/browse/trunk/src/main/java/org/owasp/esapi/codecs/HTMLEntityCodec.java]

		+	String safe = ESAPI.encoder().encodeForHTML( request.getParameter( "input" ) );

−	~~String safe = ESAPI~~.~~encoder()~~.~~encodeForHTML( request~~.~~getParameter( "input" ) );~~	+	'''PHP'''<br>
		+	[http://php.net/manual/en/function.htmlentities.php http://php.net/manual/en/function.htmlentities.php]

@@ Line 21: / Line 21: @@
 It is recommended to review where/if untrusted data is placed within entity objects.
 searching the source code fro teh followign encoders may help establish if HTML entity encoding is being done in the application and in a consistant manner. <br>
 '''OWASP Java Encoder Project'''<br>
 [https://www.owasp.org/index.php/OWASP_Java_Encoder_Project https://www.owasp.org/index.php/OWASP_Java_Encoder_Project]
@@ Line 31: / Line 28: @@
 '''OWASP ESAPI''' <br>
 [http://code.google.com/p/owasp-esapi-java/source/browse/trunk/src/main/java/org/owasp/esapi/codecs/HTMLEntityCodec.java http://code.google.com/p/owasp-esapi-java/source/browse/trunk/src/main/java/org/owasp/esapi/codecs/HTMLEntityCodec.java]

← Older revision		Revision as of 15:43, 3 October 2013
Line 23:		Line 23:

	String safe = ESAPI.encoder().encodeForHTML( request.getParameter( "input" ) );		String safe = ESAPI.encoder().encodeForHTML( request.getParameter( "input" ) );
		+
		+	'''OWASP Java Encoder Project'''<br>
		+	[https://www.owasp.org/index.php/OWASP_Java_Encoder_Project https://www.owasp.org/index.php/OWASP_Java_Encoder_Project]
		+
		+	<input type="text" name="data" value="<%= Encode.forHtmlAttribute(dataValue) %>" />
		+
		+	'''OWASP ESAPI''' <br>
		+	[http://code.google.com/p/owasp-esapi-java/source/browse/trunk/src/main/java/org/owasp/esapi/codecs/HTMLEntityCodec.java http://code.google.com/p/owasp-esapi-java/source/browse/trunk/src/main/java/org/owasp/esapi/codecs/HTMLEntityCodec.java]

← Older revision		Revision as of 15:40, 3 October 2013
Line 18:		Line 18:
	" --> &quot;		" --> &quot;
	' --> &#x27;		' --> &#x27;
		+
		+	It is recommended to review where/if untrusted data is placed within entity objects.
		+	searching the source code fro teh followign encoders may help establish if HTML entity encoding is being done in the application and in a consistant manner. <br>
		+
		+	String safe = ESAPI.encoder().encodeForHTML( request.getParameter( "input" ) );

@@ Line 5: / Line 5: @@
      HTML Body Context
-     <span>UNTRUSTED DATA</span>
+     <nowiki><span>UNTRUSTED DATA</span></nowiki>
      OR
      <body>...UNTRUSTED DATA </body>