4 ms·
XSS isn't only about SCRIPT tags. What about javascript URIs, IMG and IFRAME tags, flash elements that you can add in a page by XSS? Filtering what is shown to
by geal 16y ago
XSS isn't only about SCRIPT tags. What about javascript URIs, IMG and IFRAME tags, flash elements that you can add in a page by XSS? Filtering what is shown to the user is still the best solution IMHO.
- joe_the_user 16y agoCould explain what you mean by this? Do you mean filtering what is sent to the browser - validating libraries so user input cannot generate URIs, IMGs, etc?
- deleted 16y ago[deleted]
- geal 16y agoI mean that everytime you do "echo $myvariable;" (taking php as example), you must be sure about its content. If it's an URI, it shouldn't have the javascript:// format, if it is some plain text, it should not contain html tags, be it script, img, iframe, object tags. And you can't trust data coming out of the database (google for "persistent XSS"), so you need to filter before showing the data on output, not only on user input.
- mike-cardwell 16y agoThis is a hard problem. There are all sorts of places you can hide JS. My favourite is inside a data uri in an iframe. Eg: <iframe src="data:text/html;base64,PHNjcmlwdD5hbGVydCgnRk9PQkFSJyk8L3NjcmlwdD4="></iframe>