This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "Abridged XSS Prevention Cheat Sheet"
From OWASP
m |
m (→XSS Prevention Overview) |
||
| Line 45: | Line 45: | ||
| CSS | | CSS | ||
| <div style="width: <span style="color:red;">UNTRUSTED DATA</span>;">Selection</div> | | <div style="width: <span style="color:red;">UNTRUSTED DATA</span>;">Selection</div> | ||
| − | | <ul>[https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet#RULE_.234_-_CSS_Escape_And_Strictly_Validate_Before_Inserting_Untrusted_Data_into_HTML_Style_Property_Values Strict structural validation]<li>CSS Hex encoding<li>good design of CSS Features</ul> | + | | <ul><li>[https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet#RULE_.234_-_CSS_Escape_And_Strictly_Validate_Before_Inserting_Untrusted_Data_into_HTML_Style_Property_Values Strict structural validation]<li>CSS Hex encoding<li>good design of CSS Features</ul> |
|- | |- | ||
| String | | String | ||
Revision as of 22:51, 15 November 2011
Introduction
Cross site scripting is the most common web vulnerability. It represents a serious threat because cross site scripting allows evil attacker code to run in a victim’s browser. More details about XSS can be found here: https://www.owasp.org/index.php/Cross-site_Scripting_%28XSS%29
XSS Prevention Overview
| Data Type | Context | Code Sample | Defense |
|---|---|---|---|
| Numeric, Type safe language | Any Context | Cast to Numeric | |
| String | HTML Body | <span>UNTRUSTED DATA</span> | HTML Entity Encoding |
| String | HTML Attribute, quoted | <span id="UNTRUSTED DATA"></span> | HTML Entity Encode single and double quotes |
| String | HTML Attribute, unquoted | <span id=UNTRUSTED DATA></span> | Aggressive HTML Entity Encoding |
| String | GET Parameter | <a href="/site/search?value=UNTRUSTED DATA">clickme</a> | URL Encoding |
| String | Untrusted URL rendered in an HREF tag (or equivalent) | <a href="UNTRUSTED DATA">clickme</a> |
|
| String | CSS | <div style="width: UNTRUSTED DATA;">Selection</div> |
|
| String | JavaScript | <script>var currentValue='UNTRUSTED DATA';</script> | Strict structural JavaScript Hex Encoding |
| HTML Text | HTML Body | HTML Validation (JSoup, AnMSamy, HTML Sanitizer) | |
| String | DOM XSS | DOM based XSS Prevention Cheat Sheet |
How to Encode
Related Articles
OWASP Cheat Sheets Project Homepage
Authors and Primary Editors
Jim Manico - jim [at] owasp.org
