This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "Abridged XSS Prevention Cheat Sheet"
From OWASP
m (→XSS Prevention) |
m (→XSS Prevention) |
||
| Line 17: | Line 17: | ||
| String | | String | ||
| HTML Body | | HTML Body | ||
| − | | HTML Entity | + | | HTML Entity Encoding |
|- | |- | ||
| String | | String | ||
| HTML Attribute, quoted | | HTML Attribute, quoted | ||
| HTML Entity Encode single and double quotes | | HTML Entity Encode single and double quotes | ||
| + | |- | ||
| + | | String | ||
| + | | HTML Attribute, unquoted | ||
| + | | Aggressive HTML Entity Encoding | ||
| + | |- | ||
| + | | String | ||
| + | | GET Parameter | ||
| + | | URL Encoding | ||
| + | |- | ||
| + | | String | ||
| + | | Untrusted URL, HREF tag (or equivalent) | ||
| + | | URL Validation, reject javascript: URL’s, Whitelist http, https and other safe URL types, Attribute encoding, safe URL verification | ||
| + | |- | ||
| + | | String | ||
| + | | CSS | ||
| + | | Strict structural validation, CSS Hex encoding, good design | ||
| + | |- | ||
| + | | String | ||
| + | | HTML Text | ||
| + | | HTML Validation (JSoup, AnMSamy, HTML Sanitizer) | ||
| + | |- | ||
| + | | String | ||
| + | | DOM XSS | ||
| + | | [[DOM_based XSS Prevention Cheat Sheet] | ||
|} | |} | ||
Revision as of 02:55, 12 November 2011
Introduction
The following table briefly describes how to defeat Cross Site Scripting in a variety of different contexts.
XSS Prevention
| Data Type | Context | Defense |
|---|---|---|
| Numeric, Type safe language | Any Context | Cast to Numeric |
| String | HTML Body | HTML Entity Encoding |
| String | HTML Attribute, quoted | HTML Entity Encode single and double quotes |
| String | HTML Attribute, unquoted | Aggressive HTML Entity Encoding |
| String | GET Parameter | URL Encoding |
| String | Untrusted URL, HREF tag (or equivalent) | URL Validation, reject javascript: URL’s, Whitelist http, https and other safe URL types, Attribute encoding, safe URL verification |
| String | CSS | Strict structural validation, CSS Hex encoding, good design |
| String | HTML Text | HTML Validation (JSoup, AnMSamy, HTML Sanitizer) |
| String | DOM XSS | [[DOM_based XSS Prevention Cheat Sheet] |
Related Articles
OWASP Cheat Sheets Project Homepage
Authors and Primary Editors
Jim Manico - jim [at] owasp.org
