This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "Abridged XSS Prevention Cheat Sheet"
From OWASP
m (→Authors and Primary Editors) |
m (→XSS Prevention Overview) |
||
| Line 50: | Line 50: | ||
| HTML Text | | HTML Text | ||
| HTML Body | | HTML Body | ||
| − | | | + | | <span><span style="color:red;">UNTRUSTED HTML</span></span> |
| <ul><li>[https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet#RULE_.236_-_Use_an_HTML_Policy_engine_to_validate_or_clean_user-driven_HTML_in_an_outbound_way HTML Validation (JSoup, AntiSamy, HTML Sanitizer)]</li></ul> | | <ul><li>[https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet#RULE_.236_-_Use_an_HTML_Policy_engine_to_validate_or_clean_user-driven_HTML_in_an_outbound_way HTML Validation (JSoup, AntiSamy, HTML Sanitizer)]</li></ul> | ||
|- | |- | ||
Revision as of 03:52, 16 November 2011
DRAFT CHEAT SHEET - WORK IN PROGRESS
Introduction
Cross site scripting is the most common web vulnerability. It represents a serious threat because cross site scripting allows evil attacker code to run in a victim’s browser. More details about XSS can be found here: https://www.owasp.org/index.php/Cross-site_Scripting_%28XSS%29
XSS Prevention Overview
| Data Type | Context | Code Sample | Defense |
|---|---|---|---|
| String | HTML Body | <span>UNTRUSTED DATA</span> | |
| String | HTML Attribute, quoted | <span id="UNTRUSTED DATA"></span> |
|
| String | HTML Attribute, unquoted | <span id=UNTRUSTED DATA></span> | |
| String | GET Parameter | <a href="/site/search?value=UNTRUSTED DATA">clickme</a> | |
| String | Untrusted URL rendered in an HREF tag (or other HTML link contexts) |
<a href="UNTRUSTED DATA">clickme</a> |
|
| String | CSS | <div style="width: UNTRUSTED DATA;">Selection</div> |
|
| String | JavaScript | <script>var currentValue='UNTRUSTED DATA';</script> |
|
| HTML Text | HTML Body | <span>UNTRUSTED HTML</span> | |
| String | DOM XSS |
Output Encoding Types
| Encoding Type | Encoding Mechanism |
|---|---|
| HTML Entity Encoding | & --> & < --> < > --> > " --> " ' --> ' ' is not recommended / --> / forward slash is included as it helps end an HTML entity |
| HTML Attribute Encoding | TODO |
| URL Encoding | TODO |
| JavaScript HEX Encoding | TODO |
| CSS Hex Encoding | TODO |
Related Articles
OWASP Cheat Sheets Project Homepage
Authors and Primary Editors
Jim Manico - jim [at] owasp.org
Jeff Williams - jeff [at] aspectsecurity.com
