Category:Encoding - Revision history

Joshbw: /* Examples */

2009-09-17T18:01:55Z

‎Examples

Jeff Williams: Reverted edits by CdomaCelcd (Talk) to last version by KirstenS

2009-05-26T16:59:32Z

Reverted edits by CdomaCelcd (Talk) to last version by KirstenS

Deleted user at 17:14, 21 May 2009

2009-05-21T17:14:03Z

KirstenS at 17:26, 27 October 2008

2008-10-27T17:26:38Z

KirstenS at 12:49, 10 October 2008

2008-10-10T12:49:19Z

KirstenS at 12:10, 7 October 2008

2008-10-07T12:10:19Z

KirstenS: /* Description */

2008-09-18T12:56:08Z

‎Description

KirstenS: /* Description */

2008-09-18T12:55:07Z

‎Description

KirstenS: /* Description */

2008-09-18T12:54:36Z

‎Description

KirstenS: /* Description */

2008-09-06T15:18:04Z

‎Description

@@ Line 48: / Line 48: @@
 <u>Java Example</u>
-Unlike ASP.Net and PHP, Java does not have built in entity encoding functionality.  There is, however, an example function to perform entity encoding provided by OWASP: [[How to perform HTML entity encoding in Java]].  As a word of warning for those writing internationalized websites, the implementation is very "basic ASCII" centric in terms of encoding characters, and will encode every character not in the a-z,A-Z,0-9 range even if the page character set would normally support the characters un-encoded without issue.
+Unlike ASP.Net and PHP, Java does not have built in entity encoding functionality.  There is, however, an example function to perform entity encoding provided by OWASP: [[How to perform HTML entity encoding in Java]].  As a word of warning for those writing internationalized websites, the implementation is very "basic ASCII" centric in terms of encoding characters, and will encode every character not in the a-z,A-Z,0-9 range even if the page character set would normally support the characters un-encoded without issue.  This can dramatically increase the size of page being served.  An alternative to avoid this issue is to use the encoding function provided by the widely distributed Apache Commons Lang library. To use this library first import org.apache.commons.lang.StringEscapeUtils.  Additionally the input must be unescaped prior to encoding, hence the nested function call in the sample code below.
 ==Related Threats==

← Older revision		Revision as of 16:59, 26 May 2009
Line 1:		Line 1:
−	~~http://www.textdomoun.com~~

	==Description==		==Description==

← Older revision		Revision as of 17:14, 21 May 2009
Line 1:		Line 1:
		+	http://www.textdomoun.com

	==Description==		==Description==

@@ Line 1: / Line 1: @@
 ==Description==
@@ Line 59: / Line 58: @@
 ==Related Countermeasures==
 * [[Input Validation]]

← Older revision		Revision as of 12:49, 10 October 2008
Line 1:		Line 1:
−	{{Template:~~Countermeasure~~}}	+	{{Template:Control}}

	==Description==		==Description==

← Older revision		Revision as of 12:10, 7 October 2008
Line 59:		Line 59:
	==Related Countermeasures==		==Related Countermeasures==
	* [[Input Validation]]		* [[Input Validation]]
		+
		+
		+
		+	[[Category:Control]]

← Older revision		Revision as of 12:56, 18 September 2008
Line 17:		Line 17:

	; Double encoding and decoding?		; Double encoding and decoding?
−	: Be careful not to double encode your data. In some cases, doubly encoding data can inadvertently introduce special characters in the final output. Also, be aware that some processors may automatically undo your encoding. There is some evidence that XML processors are decoding HTML entity encoding, thus reintroducing potential [[Cross-site ~~scripting~~\|XSS]] problems.	+	: Be careful not to double encode your data. In some cases, doubly encoding data can inadvertently introduce special characters in the final output. Also, be aware that some processors may automatically undo your encoding. There is some evidence that XML processors are decoding HTML entity encoding, thus reintroducing potential [[Cross-site Scripting (XSS)\|XSS]] problems.

@@ Line 3: / Line 3: @@
 ==Description==
-Encoding, closely related to [[Escaping]] is a powerful mechanism to help protect against many types of attack, especially [[:Category:Injection Attack|injection attacks]] and [[Cross-site scripting]]. Essentially, encoding involves translating special characters into some equivalent that is no longer significant in the target interpreter. So, for example, using HTML entity encoding before sending untrusted data into a browser will protect against many forms of [[Cross-site Scripting (XSS)]].
+Encoding, closely related to [[Escaping]] is a powerful mechanism to help protect against many types of attack, especially [[:Category:Injection Attack|injection attacks]] and [[Cross-site Scripting (XSS)]]. Essentially, encoding involves translating special characters into some equivalent that is no longer significant in the target interpreter. So, for example, using HTML entity encoding before sending untrusted data into a browser will protect against many forms of [[Cross-site Scripting (XSS)]].
 Considerations:

← Older revision		Revision as of 15:18, 6 September 2008
Line 17:		Line 17:

	; Double encoding and decoding?		; Double encoding and decoding?
−	: Be careful not to double encode your data. In some cases, doubly encoding data can inadvertently introduce special characters in the final output. Also, be aware that some processors may automatically undo your encoding. There is some evidence that XML processors are decoding HTML entity encoding, thus reintroducing potential [[XSS]] problems.	+	: Be careful not to double encode your data. In some cases, doubly encoding data can inadvertently introduce special characters in the final output. Also, be aware that some processors may automatically undo your encoding. There is some evidence that XML processors are decoding HTML entity encoding, thus reintroducing potential [[Cross-site scripting\|XSS]] problems.