This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "Abridged XSS Prevention Cheat Sheet"
From OWASP
m (→XSS Prevention) |
m |
||
| Line 45: | Line 45: | ||
| String | | String | ||
| DOM XSS | | DOM XSS | ||
| − | | [[DOM_based XSS Prevention Cheat Sheet] | + | | [[DOM_based XSS Prevention Cheat Sheet]] |
|} | |} | ||
Revision as of 23:14, 13 November 2011
Introduction
The following table briefly describes how to defeat Cross Site Scripting in a variety of different contexts.
XSS Prevention
| Data Type | Context | Defense |
|---|---|---|
| Numeric, Type safe language | Any Context | Cast to Numeric |
| String | HTML Body | HTML Entity Encoding |
| String | HTML Attribute, quoted | HTML Entity Encode single and double quotes |
| String | HTML Attribute, unquoted | Aggressive HTML Entity Encoding |
| String | GET Parameter | URL Encoding |
| String | Untrusted URL, HREF tag (or equivalent) | URL Validation, reject javascript: URL’s, Whitelist http, https and other safe URL types, Attribute encoding, safe URL verification |
| String | CSS | Strict structural validation, CSS Hex encoding, good design |
| String | HTML Text | HTML Validation (JSoup, AnMSamy, HTML Sanitizer) |
| String | DOM XSS | DOM_based XSS Prevention Cheat Sheet |
Related Articles
OWASP Cheat Sheets Project Homepage
Authors and Primary Editors
Jim Manico - jim [at] owasp.org
