What are the common defenses against XSS? [closed]

by

You should refer to the excellent OWASP website for a summary of attacks (including XSS) and defenses against them. Here’s the simplest explanation I could come up with, which might actually be more readable than their web page (but probably nowhere nearly as complete).

  1. Specifying a charset. First of all, ensure that your web page specifies the UTF-8 charset in the headers or in the very beginning of the head element HTML encode all inputs to prevent a UTF-7 attack in Internet Explorer (and older versions of Firefox) despite other efforts to prevent XSS.

  2. HTML escaping. Keep in mind that you need to HTML-escape all user input. This includes replacing < with &lt;, > with &gt;, & with &amp; and " with &quot;. If you will ever use single-quoted HTML attributes, you need to replace ' with &#39; as well. Typical server-side scripting languages such as PHP provide functions to do this, and I encourage you to expand on these by creating standard functions to insert HTML elements rather than inserting them in an ad-hoc manner.

  3. Other types of escaping. You still, however, need to be careful to never insert user input as an unquoted attribute or an attribute interpreted as JavaScript (e.g. onload or onmouseover). Obviously, this also applies to script elements unless the input is properly JavaScript-escaped, which is different from HTML escaping. Another special type of escaping is URL escaping for URL parameters (do it before the HTML escaping to properly include a parameter in a link).

  4. Validating URLs and CSS values. The same goes for URLs of links and images (without validating based on approved prefixes) because of the javascript: URL scheme, and also CSS stylesheet URLs and data within style attributes. (Internet Explorer allows inserting JavaScript expressions as CSS values, and Firefox is similarly problematic with its XBL support.) If you must include a CSS value from an untrusted source, you should safely and strictly validate or CSS escape it.

  5. Not allowing user-provided HTML. Do not allow user-provided HTML if you have the option. That is an easy way to end up with an XSS problem, and so is writing a “parser” for your own markup language based on simple regex substitutions. I would only allow formatted text if the HTML output were generated in an obviously safe manner by a real parser that escapes any text from the input using the standard escaping functions and individually builds the HTML elements. If you have no choice over the matter, use a validator/sanitizer such as AntiSamy.

  6. Preventing DOM-based XSS. Do not include user input in JavaScript-generated HTML code and insert it into the document. Instead, use the proper DOM methods to ensure that it is processed as text, not HTML.

Obviously, I cannot cover every single case in which an attacker can insert JavaScript code. In general, HTTP-only cookies can be used to possibly make an XSS attack a bit harder (but by no means prevent one), and giving programmers security training is essential.

More Related Contents:

  1. What are “top level JSON arrays” and why are they a security risk?
  2. Sanitizing user input before adding it to the DOM in Javascript
  3. How to pass parameters to a Script tag?
  4. How do you use window.postMessage across domains?
  5. Cross-site AJAX requests
  6. Cross-site XMLHttpRequest
  7. How to access plain text content retrieved via in JavaScript?
  8. Allow All Content Security Policy?
  9. html() vs innerHTML jquery/javascript & XSS attacks
  10. XSS attacks and style attributes
  11. What makes an input vulnerable to XSS?
  12. Angularjs minify best practice
  13. How to use Meteor methods inside of a template helper
  14. Format numbers in JavaScript similar to C#
  15. How to convert a string to an integer in JavaScript?
  16. Add Active Navigation Class Based on URL
  17. Resize event for textarea?
  18. Using jQuery to find an element at a particular position?
  19. How do I implement Cross Domain URL Access from an Iframe using Javascript?
  20. Google Bar Chart cannot Change Individual Bar Color
  21. requestAnimationFrame with this keyword
  22. Extending Error in Javascript with ES6 syntax & Babel
  23. tag vs tag
  24. use jQuery to get values of selected checkboxes
  25. How to clearInterval with unknown ID?
  26. Calling ASP.NET Code Behind function from JavaScript
  27. javascript function name cannot set as click?
  28. Getting the position of the element in a list when it’s drag/dropped (ui.sortable)
  29. JS: Filter array of objects by max value per category
  30. whats the difference between function foo(){} and foo = function(){}? [duplicate]

Leave a Comment