This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "Abridged XSS Prevention Cheat Sheet"

From OWASP
Jump to: navigation, search
m (→‎XSS Prevention Overview)
m (→‎XSS Prevention Overview)
Line 1: Line 1:
−
= DRAFT CHEAT SHEET - WORK IN PROGRESS =
+
<h1> DRAFT CHEAT SHEET - WORK IN PROGRESS </h1>
−
= Introduction =
+
<h1> Introduction </h1>
 +
<p>Cross site scripting is the most common web vulnerability.  It represents a serious threat because cross site scripting allows evil attacker code to run in a victim’s browser.  More details about XSS can be found here:  <a href="https://www.owasp.org/index.php/Cross-site_Scripting_%28XSS%29">https://www.owasp.org/index.php/Cross-site_Scripting_%28XSS%29</a>
 +
</p>
 +
<h1> XSS Prevention Overview </h1>
 +
<table class="wikitable">
  
−
Cross site scripting is the most common web vulnerability. It represents a serious threat because cross site scripting allows evil attacker code to run in a victim’s browser.  More details about XSS can be found here: [https://www.owasp.org/index.php/Cross-site_Scripting_%28XSS%29 https://www.owasp.org/index.php/Cross-site_Scripting_%28XSS%29]
+
<tr>
 +
<th> Data Type
 +
</th><th> Context
 +
</th><th> Code Sample
 +
</th><th> Defense
 +
</th></tr>
 +
<tr>
 +
<td> String
 +
</td><td> HTML Body
 +
</td><td> &lt;span&gt;<span style="color:red;">UNTRUSTED DATA</span>&lt;/span&gt;
 +
</td><td> <ul><li><a href="https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet#RULE_.231_-_HTML_Escape_Before_Inserting_Untrusted_Data_into_HTML_Element_Content">HTML Entity Encoding</a></li></ul>
 +
</td></tr>
 +
<tr>
 +
<td> String
 +
</td><td> "safe" HTML Attributes<br />(align, alink, alt, bgcolor, border,<br />cellpadding, cellspacing, class, color, cols, colspan,<br />coords, dir, face, height, hspace, ismap, lang, marginheight,<br />marginwidth, multiple, nohref, noresize, noshade, nowrap, ref, rel,<br />rev, rows, rowspan, scrolling, shape, span, summary, tabindex,<br />title, usemap, valign, value, vlink, vspace, width)
 +
</td><td> &lt;input type="text" name="fname" value="<span style="color:red;">UNTRUSTED DATA</span>"&gt;
 +
</td><td> <ul><li><a href="https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet#RULE_.232_-_Attribute_Escape_Before_Inserting_Untrusted_Data_into_HTML_Common_Attributes">Aggressive HTML Entity Encoding</a></li><li>Avoid placing untrusted data in an ID attribute (it can influence the DOM even when escaped)</li><li>Only place untrusted data into a whitelist of safe attributes</li><li>Strictly validate unsafe attributes such as background, id and name.</ul>
 +
</td></tr>
 +
<tr>
 +
<td> String
 +
</td><td> GET Parameter
 +
</td><td> &lt;a href="/site/search?value=<span style="color:red;">UNTRUSTED DATA</span>"&gt;clickme&lt;/a&gt;
 +
</td><td> <ul><li><a href="https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet#RULE_.235_-_URL_Escape_Before_Inserting_Untrusted_Data_into_HTML_URL_Parameter_Values">URL Encoding</a></li></ul>
 +
</td></tr>
 +
<tr>
 +
<td> String
 +
</td><td> Untrusted URL rendered in an HREF tag<br />(or other HTML link context)
 +
</td><td> &lt;a href="<span style="color:red;">UNTRUSTED DATA</span>"&gt;clickme&lt;/a&gt;<br />&lt;iframe src="<span style="color:red;">UNTRUSTED DATA</span>" /&gt;
 +
</td><td> <ul><li>Cannonicalize input</li><li>URL Validation</li><li>Safe URL verification</li><li>Whitelist http and https URL's only</li><li>Attribute encoder</li></ul>
 +
</td></tr>
 +
<tr>
 +
<td> String
 +
</td><td> CSS
 +
</td><td> &lt;div style="width: <span style="color:red;">UNTRUSTED DATA</span>;"&gt;Selection&lt;/div&gt;
 +
</td><td> <ul><li><a href="https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet#RULE_.234_-_CSS_Escape_And_Strictly_Validate_Before_Inserting_Untrusted_Data_into_HTML_Style_Property_Values">Strict structural validation</a><li>CSS Hex encoding<li>good design of CSS Features</ul>
 +
</td></tr>
 +
<tr>
 +
<td> String
 +
</td><td> JavaScript
 +
</td><td> &lt;script&gt;var currentValue='<span style="color:red;">UNTRUSTED DATA</span>';&lt;/script&gt;
 +
</td><td> <ul><li>Ensure JavaScript variables are quoted</li><li>JavaScript Hex Encoding</li><li>JavaScript Unicode Encoding</li><li>Avoid backslash encoding (\" or \' or \\)</li></ul>
 +
</td></tr>
 +
<tr>
 +
<td> String
 +
</td><td> HTML Comment
 +
</td><td> &lt;!-- <span style="color:red;">UNTRUSTED DATA</span>--&gt;
 +
</td><td> TODO
 +
</td></tr>
 +
<tr>
 +
<td> String
 +
</td><td> JavaScript Comment
 +
</td><td> /*<br /><span style="color:red;">UNTRUSTED DATA</span><br />*/
 +
</td><td> TODO
 +
</td></tr>
 +
<tr>
 +
<td> HTML Text
 +
</td><td> HTML Body
 +
</td><td> &lt;span&gt;<span style="color:red;">UNTRUSTED HTML</span>&lt;/span&gt;
 +
</td><td> <ul><li><a href="https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet#RULE_.236_-_Use_an_HTML_Policy_engine_to_validate_or_clean_user-driven_HTML_in_an_outbound_way">HTML Validation (JSoup, AntiSamy, HTML Sanitizer)</a></li></ul>
 +
</td></tr>
 +
<tr>
 +
<td> String
 +
</td><td> DOM XSS
 +
</td><td> TODO
 +
</td><td> <ul><li><a _fcknotitle="true" href="DOM based XSS Prevention Cheat Sheet">DOM based XSS Prevention Cheat Sheet</a></li></ul>
 +
</td></tr>
 +
<tr>
 +
<td> String
 +
</td><td> AJAX/JSON Parsing
 +
</td><td> TODO
 +
</td><td> <ul><li>Use JSON.parse or json2.js library to parse JSON</li><li>Avoid parsing JSON with eval()</li></ul>
 +
</td></tr>
 +
<tr>
 +
<td> String
 +
</td><td> AJAX/XML Parsing
 +
</td><td> TODO
 +
</td><td> TODO
 +
</td></tr></table>
 +
<h1> Output Encoding Types </h1>
 +
<table class="wikitable">
  
−
= XSS Prevention Overview =
+
<tr>
−
 
+
<th> Encoding Type
−
{| class="wikitable"
+
</th><th> Encoding Mechanism
−
|-
+
</th></tr>
−
! Data Type
+
<tr>
−
! Context
+
<td> HTML Entity Encoding
−
! Code Sample
+
</td><td>   &amp; --&gt; &amp;amp;<br />&lt; --&gt; &amp;lt;<br />&gt; --&gt; &amp;gt;<br />" --&gt; &amp;quot;<br />' --&gt; &amp;#x27;     &amp;apos; is not recommended<br />/ --&gt; &amp;#x2F;     forward slash is included as it helps end an HTML entity
−
! Defense
+
</td></tr>
−
|-
+
<tr>
−
| String
+
<td> HTML Attribute Encoding
−
| HTML Body
+
</td><td> TODO
−
| &lt;span><span style="color:red;">UNTRUSTED DATA</span>&lt;/span>
+
</td></tr>
−
| <ul><li>[https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet#RULE_.231_-_HTML_Escape_Before_Inserting_Untrusted_Data_into_HTML_Element_Content HTML Entity Encoding]</li></ul>
+
<tr>
−
|-
+
<td> URL Encoding
−
| String
+
</td><td> TODO
−
| "safe" HTML Attributes<br/>(align, alink, alt, bgcolor, border,<br/>cellpadding, cellspacing, class, color, cols, colspan,<br/>coords, dir, face, height, hspace, ismap, lang, marginheight,<br/>marginwidth, multiple, nohref, noresize, noshade, nowrap, ref, rel,<br/>rev, rows, rowspan, scrolling, shape, span, summary, tabindex,<br/>title, usemap, valign, value, vlink, vspace, width)
+
</td></tr>
−
| &lt;input type="text" name="fname" value="<span style="color:red;">UNTRUSTED DATA</span>">
+
<tr>
−
| <ul><li>[https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet#RULE_.232_-_Attribute_Escape_Before_Inserting_Untrusted_Data_into_HTML_Common_Attributes Aggressive HTML Entity Encoding]</li><li>Avoid placing untrusted data in an ID attribute (it can influence the DOM even when escaped)</li><li>Only place untrusted data into a whitelist of safe attributes</li><li>Strictly validate unsafe attributes such as background, id and name.</ul>
+
<td> JavaScript HEX Encoding
−
|-
+
</td><td> TODO
−
| String
+
</td></tr>
−
| GET Parameter
+
<tr>
−
| &lt;a href="/site/search?value=<span style="color:red;">UNTRUSTED DATA</span>">clickme&lt;/a>
+
<td> CSS Hex Encoding
−
| <ul><li>[https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet#RULE_.235_-_URL_Escape_Before_Inserting_Untrusted_Data_into_HTML_URL_Parameter_Values URL Encoding]</li></ul>
+
</td><td> TODO
−
|-
+
</td></tr></table>
−
| String
+
<h1> Related Articles </h1>
−
| Untrusted URL rendered in an HREF tag<br/>(or other HTML link context)
+
<p><span class="fck_mw_template">{{Cheatsheet_Navigation}}</span>
−
| &lt;a href="<span style="color:red;">UNTRUSTED DATA</span>">clickme&lt;/a><br/>&lt;iframe src="<span style="color:red;">UNTRUSTED DATA</span>" />
+
</p>
−
| <ul><li>Cannonicalize input</li><li>URL Validation</li><li>Safe URL verification</li><li>Whitelist http and https URL's only</li><li>Attribute encoder</li></ul>
+
<h1> Authors and Primary Editors  </h1>
−
|-
+
<p>Jim Manico - jim [at] owasp.org<br />
−
| String
 
−
| CSS
 
−
| &lt;div style="width: <span style="color:red;">UNTRUSTED DATA</span>;">Selection&lt;/div>
 
−
| <ul><li>[https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet#RULE_.234_-_CSS_Escape_And_Strictly_Validate_Before_Inserting_Untrusted_Data_into_HTML_Style_Property_Values Strict structural validation]<li>CSS Hex encoding<li>good design of CSS Features</ul>
 
−
|-
 
−
| String
 
−
| JavaScript
 
−
| &lt;script>var currentValue='<span style="color:red;">UNTRUSTED DATA</span>';&lt;/script>
 
−
| <ul><li>Ensure JavaScript variables are quoted</li><li>JavaScript Hex Encoding</li><li>JavaScript Unicode Encoding</li><li>Avoid backslash encoding (\" or \' or \\)</li></ul>
 
−
|-
 
−
| String
 
−
| HTML Comment
 
−
| &lt;!-- <span style="color:red;">UNTRUSTED DATA</span>--&gt;
 
−
| TODO
 
−
|-
 
−
| String
 
−
| JavaScript Comment
 
−
| /*<br/><span style="color:red;">UNTRUSTED DATA</span><br/>*/
 
−
| TODO
 
−
|-
 
−
| HTML Text
 
−
| HTML Body
 
−
| &lt;span><span style="color:red;">UNTRUSTED HTML</span>&lt;/span>
 
−
| <ul><li>[https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet#RULE_.236_-_Use_an_HTML_Policy_engine_to_validate_or_clean_user-driven_HTML_in_an_outbound_way HTML Validation (JSoup, AntiSamy, HTML Sanitizer)]</li></ul>  
 
−
|-
 
−
| String
 
−
| DOM XSS
 
−
| TODO
 
−
| <ul><li>[[DOM based XSS Prevention Cheat Sheet]]</li></ul>
 
−
|-
 
−
| String
 
−
| AJAX/JSON Parsing
 
−
| TODO
 
−
| <ul><li>Use JSON.parse or json2.js library to parse JSON</li><li>Avoid parsing JSON with eval()</li></ul>
 
−
|-
 
−
| String
 
−
| AJAX/XML Parsing
 
−
| TODO
 
−
| TODO
 
−
|}
 
−
 
 
−
= Output Encoding Types =
 
−
 
 
−
{| class="wikitable"
 
−
|-
 
−
! Encoding Type
 
−
! Encoding Mechanism
 
−
|-
 
−
| HTML Entity Encoding
 
−
|  & --> &amp;amp;<br/>< --> &amp;lt;<br/>> --> &amp;gt;<br/>" --> &amp;quot;<br/>' --> &amp;#x27;    &apos; is not recommended<br/>/ --> &amp;#x2F;    forward slash is included as it helps end an HTML entity
 
−
|-
 
−
| HTML Attribute Encoding
 
−
| TODO
 
−
|-
 
−
| URL Encoding
 
−
| TODO
 
−
|-
 
−
| JavaScript HEX Encoding
 
−
| TODO
 
−
|-
 
−
| CSS Hex Encoding
 
−
| TODO
 
−
|}
 
−
 
 
−
= Related Articles =
 
−
 
 
−
{{Cheatsheet_Navigation}}
 
−
 
 
−
= Authors and Primary Editors  =
 
−
 
 
−
Jim Manico - jim [at] owasp.org<br/>
 
 
Jeff Williams - jeff [at] aspectsecurity.com
 
Jeff Williams - jeff [at] aspectsecurity.com
−
 
+
</p><a _fcknotitle="true" href="Category:Cheatsheets">Cheatsheets</a>
−
[[Category:Cheatsheets]]
 

Revision as of 11:20, 16 November 2011

DRAFT CHEAT SHEET - WORK IN PROGRESS

Introduction

Cross site scripting is the most common web vulnerability. It represents a serious threat because cross site scripting allows evil attacker code to run in a victim’s browser. More details about XSS can be found here: <a href="https://www.owasp.org/index.php/Cross-site_Scripting_%28XSS%29">https://www.owasp.org/index.php/Cross-site_Scripting_%28XSS%29</a>

XSS Prevention Overview

Data Type Context Code Sample Defense
String HTML Body <span>UNTRUSTED DATA</span>
String "safe" HTML Attributes
(align, alink, alt, bgcolor, border,
cellpadding, cellspacing, class, color, cols, colspan,
coords, dir, face, height, hspace, ismap, lang, marginheight,
marginwidth, multiple, nohref, noresize, noshade, nowrap, ref, rel,
rev, rows, rowspan, scrolling, shape, span, summary, tabindex,
title, usemap, valign, value, vlink, vspace, width) 		<input type="text" name="fname" value="UNTRUSTED DATA">
String GET Parameter <a href="/site/search?value=UNTRUSTED DATA">clickme</a>
String Untrusted URL rendered in an HREF tag
(or other HTML link context) 		<a href="UNTRUSTED DATA">clickme</a>
<iframe src="UNTRUSTED DATA" />
  • Cannonicalize input
  • URL Validation
  • Safe URL verification
  • Whitelist http and https URL's only
  • Attribute encoder
String CSS <div style="width: UNTRUSTED DATA;">Selection</div>
String JavaScript <script>var currentValue='UNTRUSTED DATA';</script>
  • Ensure JavaScript variables are quoted
  • JavaScript Hex Encoding
  • JavaScript Unicode Encoding
  • Avoid backslash encoding (\" or \' or \\)
String HTML Comment <!-- UNTRUSTED DATA--> TODO
String JavaScript Comment /*
UNTRUSTED DATA
*/ 		TODO
HTML Text HTML Body <span>UNTRUSTED HTML</span>
String DOM XSS TODO
  • <a _fcknotitle="true" href="DOM based XSS Prevention Cheat Sheet">DOM based XSS Prevention Cheat Sheet</a>
String AJAX/JSON Parsing TODO
  • Use JSON.parse or json2.js library to parse JSON
  • Avoid parsing JSON with eval()
String AJAX/XML Parsing TODO TODO

Output Encoding Types

Encoding Type Encoding Mechanism
HTML Entity Encoding & --> &amp;
< --> &lt;
> --> &gt;
" --> &quot;
' --> &#x27; &apos; is not recommended
/ --> &#x2F; forward slash is included as it helps end an HTML entity
HTML Attribute Encoding TODO
URL Encoding TODO
JavaScript HEX Encoding TODO
CSS Hex Encoding TODO

Related Articles

OWASP Cheat Sheets Project Homepage

V - T - E Cheat Sheets
Developer / Builder
Assessment / Breaker
Mobile
OpSec / Defender
Draft and Beta
All Pages In This Category

Authors and Primary Editors

Jim Manico - jim [at] owasp.org
Jeff Williams - jeff [at] aspectsecurity.com

<a _fcknotitle="true" href="Category:Cheatsheets">Cheatsheets</a>
Retrieved from "https://wiki.owasp.org/index.php?title=Abridged_XSS_Prevention_Cheat_Sheet&oldid=120273"