This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "Abridged XSS Prevention Cheat Sheet"

From OWASP
Jump to: navigation, search
m
m (→‎XSS Prevention Overview)
Line 16: Line 16:
 
| HTML Body
 
| HTML Body
 
| &lt;span><span style="color:red;">UNTRUSTED DATA</span>&lt;/span>
 
| &lt;span><span style="color:red;">UNTRUSTED DATA</span>&lt;/span>
−
| [https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet#RULE_.231_-_HTML_Escape_Before_Inserting_Untrusted_Data_into_HTML_Element_Content HTML Entity Encoding]
+
| <ul><li>[https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet#RULE_.231_-_HTML_Escape_Before_Inserting_Untrusted_Data_into_HTML_Element_Content HTML Entity Encoding]</li></ul>
 
|-
 
|-
 
| String
 
| String
 
| HTML Attribute, quoted
 
| HTML Attribute, quoted
 
| &lt;span id="<span style="color:red;">UNTRUSTED DATA</span>">&lt;/span>
 
| &lt;span id="<span style="color:red;">UNTRUSTED DATA</span>">&lt;/span>
−
| HTML Entity Encode single and double quotes
+
| <ul><li>HTML Entity Encode single and double quotes</li></ul>
 
|-
 
|-
 
| String
 
| String
 
| HTML Attribute, unquoted
 
| HTML Attribute, unquoted
 
| &lt;span id=<span style="color:red;">UNTRUSTED DATA</span>>&lt;/span>
 
| &lt;span id=<span style="color:red;">UNTRUSTED DATA</span>>&lt;/span>
−
| [https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet#RULE_.232_-_Attribute_Escape_Before_Inserting_Untrusted_Data_into_HTML_Common_Attributes Aggressive HTML Entity Encoding]
+
| <ul><li>[https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet#RULE_.232_-_Attribute_Escape_Before_Inserting_Untrusted_Data_into_HTML_Common_Attributes Aggressive HTML Entity Encoding]</li></ul>
 
|-
 
|-
 
| String
 
| String
 
| GET Parameter
 
| GET Parameter
 
| &lt;a href="/site/search?value=<span style="color:red;">UNTRUSTED DATA</span>">clickme&lt;/a>
 
| &lt;a href="/site/search?value=<span style="color:red;">UNTRUSTED DATA</span>">clickme&lt;/a>
−
| [https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet#RULE_.235_-_URL_Escape_Before_Inserting_Untrusted_Data_into_HTML_URL_Parameter_Values URL Encoding]
+
| <ul><li>[https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet#RULE_.235_-_URL_Escape_Before_Inserting_Untrusted_Data_into_HTML_URL_Parameter_Values URL Encoding]</li></ul>
 
|-
 
|-
 
| String
 
| String
Line 51: Line 51:
 
| HTML Body
 
| HTML Body
 
|
 
|
−
| [https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet#RULE_.236_-_Use_an_HTML_Policy_engine_to_validate_or_clean_user-driven_HTML_in_an_outbound_way HTML Validation (JSoup, AntiSamy, HTML Sanitizer)]  
+
| <ul><li>[https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet#RULE_.236_-_Use_an_HTML_Policy_engine_to_validate_or_clean_user-driven_HTML_in_an_outbound_way HTML Validation (JSoup, AntiSamy, HTML Sanitizer)]</li></ul>
 
|-
 
|-
 
| String
 
| String

Revision as of 03:19, 16 November 2011

DRAFT CHEAT SHEET - WORK IN PROGRESS

Introduction

Cross site scripting is the most common web vulnerability. It represents a serious threat because cross site scripting allows evil attacker code to run in a victim’s browser. More details about XSS can be found here: https://www.owasp.org/index.php/Cross-site_Scripting_%28XSS%29

XSS Prevention Overview

Data Type Context Code Sample Defense
String HTML Body <span>UNTRUSTED DATA</span>
String HTML Attribute, quoted <span id="UNTRUSTED DATA"></span>
  • HTML Entity Encode single and double quotes
String HTML Attribute, unquoted <span id=UNTRUSTED DATA></span>
String GET Parameter <a href="/site/search?value=UNTRUSTED DATA">clickme</a>
String Untrusted URL rendered in an HREF tag
(or other HTML link contexts) 		<a href="UNTRUSTED DATA">clickme</a>
  • URL Validation
  • reject javascript: URL’s
  • Whitelist http, https and other safe URL types
  • Attribute encoding
  • safe URL verification
String CSS <div style="width: UNTRUSTED DATA;">Selection</div>
String JavaScript <script>var currentValue='UNTRUSTED DATA';</script>
  • Ensure JavaScript variables are quoted
  • JavaScript Hex Encoding
HTML Text HTML Body
String DOM XSS DOM based XSS Prevention Cheat Sheet

Output Encoding Types

Encoding Type Encoding Mechanism
HTML Entity Encoding & --> &amp;
< --> &lt;
> --> &gt;
" --> &quot;
' --> &#x27; ' is not recommended
/ --> &#x2F; forward slash is included as it helps end an HTML entity
HTML Attribute Encoding TODO
URL Encoding TODO
JavaScript HEX Encoding TODO
CSS Hex Encoding TODO

Related Articles

OWASP Cheat Sheets Project Homepage


V - T - E Cheat Sheets
Developer / Builder
Assessment / Breaker
Mobile
OpSec / Defender
Draft and Beta
All Pages In This Category

Authors and Primary Editors

Jim Manico - jim [at] owasp.org

Retrieved from "https://wiki.owasp.org/index.php?title=Abridged_XSS_Prevention_Cheat_Sheet&oldid=120226"