This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "Abridged XSS Prevention Cheat Sheet"
From OWASP
m (→XSS Prevention) |
m (→XSS Prevention) |
||
| Line 29: | Line 29: | ||
| String | | String | ||
| GET Parameter | | GET Parameter | ||
| − | | URL Encoding | + | | [https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet#RULE_.235_-_URL_Escape_Before_Inserting_Untrusted_Data_into_HTML_URL_Parameter_Values URL Encoding] |
|- | |- | ||
| String | | String | ||
| Untrusted URL rendered in an HREF tag (or equivalent) | | Untrusted URL rendered in an HREF tag (or equivalent) | ||
| − | | | + | | URL Validation, reject javascript: URL’s, Whitelist http, https and other safe URL types, Attribute encoding, safe URL verification |
|- | |- | ||
| String | | String | ||
Revision as of 23:18, 13 November 2011
Introduction
The following table briefly describes how to defeat Cross Site Scripting in a variety of different contexts.
XSS Prevention
| Data Type | Context | Defense |
|---|---|---|
| Numeric, Type safe language | Any Context | Cast to Numeric |
| String | HTML Body | HTML Entity Encoding |
| String | HTML Attribute, quoted | HTML Entity Encode single and double quotes |
| String | HTML Attribute, unquoted | Aggressive HTML Entity Encoding |
| String | GET Parameter | URL Encoding |
| String | Untrusted URL rendered in an HREF tag (or equivalent) | URL Validation, reject javascript: URL’s, Whitelist http, https and other safe URL types, Attribute encoding, safe URL verification |
| String | CSS | Strict structural validation, CSS Hex encoding, good design |
| String | HTML Text | HTML Validation (JSoup, AnMSamy, HTML Sanitizer) |
| String | DOM XSS | DOM_based XSS Prevention Cheat Sheet |
Related Articles
OWASP Cheat Sheets Project Homepage
Authors and Primary Editors
Jim Manico - jim [at] owasp.org
