This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "Abridged XSS Prevention Cheat Sheet"
From OWASP
m (→XSS Prevention) |
m (→XSS Prevention) |
||
| Line 46: | Line 46: | ||
| <div style="width: <span style="color:red;">UNTRUSTED DATA</span>;">Selection</div> | | <div style="width: <span style="color:red;">UNTRUSTED DATA</span>;">Selection</div> | ||
| [https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet#RULE_.234_-_CSS_Escape_And_Strictly_Validate_Before_Inserting_Untrusted_Data_into_HTML_Style_Property_Values Strict structural validation, CSS Hex encoding, good design] | | [https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet#RULE_.234_-_CSS_Escape_And_Strictly_Validate_Before_Inserting_Untrusted_Data_into_HTML_Style_Property_Values Strict structural validation, CSS Hex encoding, good design] | ||
| + | |- | ||
| + | | String | ||
| + | | JavaScript | ||
| + | | <script>var currentValue='<span style="color:red;">UNTRUSTED DATA</span>';</script> | ||
| + | | [https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet#RULE_.233_-_JavaScript_Escape_Before_Inserting_Untrusted_Data_into_JavaScript_Data_Values Strict structural JavaScript Hex Encoding] | ||
|- | |- | ||
| HTML Text | | HTML Text | ||
Revision as of 08:48, 15 November 2011
Introduction
The following table briefly describes how to defeat Cross Site Scripting in a variety of different contexts.
XSS Prevention
| Data Type | Context | Code Sample | Defense |
|---|---|---|---|
| Numeric, Type safe language | Any Context | Cast to Numeric | |
| String | HTML Body | <span>UNTRUSTED DATA</span> | HTML Entity Encoding |
| String | HTML Attribute, quoted | <span id="UNTRUSTED DATA"></span> | HTML Entity Encode single and double quotes |
| String | HTML Attribute, unquoted | <span id=UNTRUSTED DATA></span> | Aggressive HTML Entity Encoding |
| String | GET Parameter | <a href="/site/search?value=UNTRUSTED DATA">clickme</a> | URL Encoding |
| String | Untrusted URL rendered in an HREF tag (or equivalent) | <a href="UNTRUSTED DATA">clickme</a> | URL Validation reject javascript: URL’s Whitelist http, https and other safe URL types Attribute encoding safe URL verification |
| String | CSS | <div style="width: UNTRUSTED DATA;">Selection</div> | Strict structural validation, CSS Hex encoding, good design |
| String | JavaScript | <script>var currentValue='UNTRUSTED DATA';</script> | Strict structural JavaScript Hex Encoding |
| HTML Text | HTML Body | HTML Validation (JSoup, AnMSamy, HTML Sanitizer) | |
| String | DOM XSS | DOM_based XSS Prevention Cheat Sheet |
Related Articles
OWASP Cheat Sheets Project Homepage
Authors and Primary Editors
Jim Manico - jim [at] owasp.org
