This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "Abridged XSS Prevention Cheat Sheet"
From OWASP
m (→XSS Prevention) |
m (→XSS Prevention) |
||
| Line 36: | Line 36: | ||
| String | | String | ||
| Untrusted URL rendered in an HREF tag (or equivalent) | | Untrusted URL rendered in an HREF tag (or equivalent) | ||
| − | | URL Validation | + | | URL Validation<br/>reject javascript: URL’s<br/>Whitelist http, https and other safe URL types<br/>Attribute encoding<br/>safe URL verification |
|- | |- | ||
| String | | String | ||
Revision as of 08:37, 15 November 2011
Introduction
The following table briefly describes how to defeat Cross Site Scripting in a variety of different contexts.
XSS Prevention
| Data Type | Context | Defense | Code Sample |
|---|---|---|---|
| Numeric, Type safe language | Any Context | Cast to Numeric | |
| String | HTML Body | HTML Entity Encoding | <span>UNTRUSTED DATA</span> |
| String | HTML Attribute, quoted | HTML Entity Encode single and double quotes | |
| String | HTML Attribute, unquoted | Aggressive HTML Entity Encoding | |
| String | GET Parameter | URL Encoding | |
| String | Untrusted URL rendered in an HREF tag (or equivalent) | URL Validation reject javascript: URL’s Whitelist http, https and other safe URL types Attribute encoding safe URL verification | |
| String | CSS | Strict structural validation, CSS Hex encoding, good design | |
| HTML Text | HTML Body | HTML Validation (JSoup, AnMSamy, HTML Sanitizer) | |
| String | DOM XSS | DOM_based XSS Prevention Cheat Sheet |
Related Articles
OWASP Cheat Sheets Project Homepage
Authors and Primary Editors
Jim Manico - jim [at] owasp.org
