Abridged XSS Prevention Cheat Sheet

Introduction

Cross site scripting is the most common web vulnerability. Cross Site Scripting is a dangerous threat since it allows an attacker to trick a victim into executing malicious client-side script in a browser. This cheat sheet is a derivative work of the XSS (Cross Site Scripting) Prevention Cheat Sheet and will assist web developers in eliminating XSS from their applications.

XSS Prevention by Context

The following snippets of HTML demonstrate how to safely render untrusted data in a variety of different contexts.

Data Type	Context	Code Sample	Defense
String	HTML Body	<span>UNTRUSTED DATA</span>	HTML Entity Encoding
String	Safe HTML Attributes	<input type="text" name="fname" value="UNTRUSTED DATA">	Aggressive HTML Entity Encoding Only place untrusted data into a whitelist of safe attributes (listed below). Strictly validate unsafe attributes such as background, id and name.
String	GET Parameter	<a href="/site/search?value=UNTRUSTED DATA">clickme</a>	URL Encoding
String	Untrusted URL in a SRC or HREF attribute	<a href="UNTRUSTED DATA">clickme</a> <iframe src="UNTRUSTED DATA" />	Cannonicalize input URL Validation Safe URL verification Whitelist http and https URL's only Attribute encoder
String	CSS Value	<div style="width: UNTRUSTED DATA;">Selection</div>	Strict structural validation CSS Hex encoding Good design of CSS Features
String	JavaScript Variable	<script>var currentValue='UNTRUSTED DATA';</script> <script>someFunction('UNTRUSTED DATA');</script>	Ensure JavaScript variables are quoted JavaScript Hex Encoding JavaScript Unicode Encoding Avoid backslash encoding (\" or \' or \\)
HTML	HTML Body	<div>UNTRUSTED HTML</div>	HTML Validation (JSoup, AntiSamy, HTML Sanitizer)
JavaScript	HTML Body	<div>UNTRUSTED JAVASCRIPT</div>	Sandboxing with tools such as JSReg
String	DOM XSS	TODO	DOM based XSS Prevention Cheat Sheet
String	AJAX/JSON Parsing	JSON.parse(UNTRUSTED JSON DATA)	Use JSON.parse or json2.js library to parse JSON Avoid parsing JSON with eval() as it will execute any script included with the JSON
String	AJAX/HTML	TODO	Userdata must be properly encoded serverside according to the rules above
String	AJAX/XML Parsing	TODO	TODO
String	Framework Protections	<span>UNTRUSTED DATA</span>	Content Security Policy HTML5 Frame Sandbox

Safe HTML Attributes include: align, alink, alt, bgcolor, border, cellpadding, cellspacing, class, color, cols, colspan, coords, dir, face, height, hspace, ismap, lang, marginheight, marginwidth, multiple, nohref, noresize, noshade, nowrap, ref, rel, rev, rows, rowspan, scrolling, shape, span, summary, tabindex, title, usemap, valign, value, vlink, vspace, width

XSS Prevention Dangerous Contexts

The following snippets of HTML demonstrate dangerous contexts that developers should always avoid.

Data Type	Context	Code Sample	Danger
String	HTML Comment	<!-- UNTRUSTED DATA -->	There are a variety of browser quirks that make this context, even when encoded, dangerous, and therefor should be avoided.
String	JavaScript Comment	/* UNTRUSTED DATA */	Danger, for example Chrome JavaScript comments [1] Output Encoding The purpose of output encoding (as it relates to Cross Site Scripting) is to convert untrusted input into a safe form where the input is displayed as data to the user without executing as code in the browser. The following charts details a list of critical output encoding methods needed to stop Cross Site Scripting. Encoding Type Encoding Mechanism HTML Entity Encoding Convert & to &amp; Convert < to &lt; Convert > to &gt; Convert " to &quot; Convert ' to &#x27; Convert / to &#x2F; HTML Attribute Encoding Except for alphanumeric characters, escape all characters with the HTML Entity &#xHH; format, including spaces. (HH = Hex Value) URL Encoding Standard percent encoding, see: http://www.w3schools.com/tags/ref_urlencode.asp JavaScript Encoding Except for alphanumeric characters, escape all characters with the \uXXXX unicode escaping format (X = Integer). CSS Hex Encoding CSS escaping supports \XX and \XXXXXX. Using a two character escape can cause problems if the next character continues the escape sequence. There are two solutions (a) Add a space after the CSS escape (will be ignored by the CSS parser) (b) use the full amount of CSS escaping possible by zero padding the value. Related Articles OWASP Cheat Sheets Project Homepage OWASP Cheat Sheet Series V - T - E Cheat Sheets Developer / Builder 3rd Party Javascript Management Access Control AJAX Security Cheat Sheet Authentication (ES) Bean Validation Cheat Sheet Choosing and Using Security Questions Clickjacking Defense Credential Stuffing Prevention Cheat Sheet Cross-Site Request Forgery (CSRF) Prevention Cryptographic Storage C-Based Toolchain Hardening CSS Security Deserialization DOM based XSS Prevention Forgot Password HTML5 Security HTTP Strict Transport Security Injection Prevention Cheat Sheet Injection Prevention Cheat Sheet in Java JSON Web Token (JWT) Cheat Sheet for Java Input Validation Insecure Direct Object Reference Prevention JAAS Key Management LDAP Injection Prevention Logging Mass Assignment Cheat Sheet .NET Security OS Command Injection Defense Cheat Sheet OWASP Top Ten Password Storage Pinning Query Parameterization REST Security Ruby on Rails Session Management SAML Security SQL Injection Prevention Transaction Authorization Transport Layer Protection TLS Cipher String Configuration Unvalidated Redirects and Forwards User Privacy Protection Web Service Security XSS (Cross Site Scripting) Prevention XML External Entity (XXE) Prevention Cheat Sheet Assessment / Breaker Attack Surface Analysis REST Assessment Web Application Security Testing XML Security Cheat Sheet XSS Filter Evasion Mobile Android Testing IOS Developer Mobile Jailbreaking OpSec / Defender Virtual Patching Vulnerability Disclosure Draft and Beta Application Security Architecture Business Logic Security Content Security Policy Denial of Service Cheat Sheet Grails Secure Code Review IOS Application Security Testing PHP Security Regular Expression Security Cheatsheet Secure Coding Secure SDLC Threat Modeling All Pages In This Category Authors and Primary Editors Jim Manico - jim [at] owasp.org Jeff Williams - jeff [at] aspectsecurity.com