This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "Abridged XSS Prevention Cheat Sheet"
From OWASP
m (→XSS Prevention Overview) |
m (→XSS Prevention Overview) |
||
| Line 1: | Line 1: | ||
= XSS Prevention Overview = | = XSS Prevention Overview = | ||
| − | {| class="wikitable" | + | {| class="wikitable nowraplinks" |
|- | |- | ||
! Data Type | ! Data Type | ||
Revision as of 11:33, 16 November 2011
XSS Prevention Overview
| Data Type | Context | Code Sample | Defense |
|---|---|---|---|
| String | HTML Body | <span>UNTRUSTED DATA</span> | |
| String | "safe" HTML Attributes | <input type="text" name="fname" value="UNTRUSTED DATA"> |
|
| String | GET Parameter | <a href="/site/search?value=UNTRUSTED DATA">clickme</a> | |
| String | Untrusted URL rendered in an HREF tag (or other HTML link context) |
<a href="UNTRUSTED DATA">clickme</a> <iframe src="UNTRUSTED DATA" /> |
|
| String | CSS | <div style="width: UNTRUSTED DATA;">Selection</div> |
|
| String | JavaScript | <script>var currentValue='UNTRUSTED DATA';</script> |
|
| String | HTML Comment | <!-- UNTRUSTED DATA--> | TODO |
| String | JavaScript Comment | /* UNTRUSTED DATA */ |
TODO |
| HTML Text | HTML Body | <span>UNTRUSTED HTML</span> | |
| String | DOM XSS | TODO | |
| String | AJAX/JSON Parsing | TODO |
|
| String | AJAX/XML Parsing | TODO | TODO |