3 ms·
5. Use proper API instead of escaping. (client-side) Say you assign your non-static data to el.textContent instead of concatenating strings into something that'
by megous 6y ago
5. Use proper API instead of escaping. (client-side) Say you assign your non-static data to el.textContent instead of concatenating strings into something that's to be interpreted as markup/code. Or you use DOMParser to parse markup safely, and then extract data from it or prune it using a whitelist via regular DOM API.
5a. Block all access to unsafe ways to use strings as code/markup via trusted-types CSP. (at least during development)
Conceptually the same thing you do with SQL server side. Parametrize the queries, instead of escaping and pasting into the query.
- lucideer 6y agoGreat point! It wanted to edit the comment to change (1) to (server/client) but I passed my edit timeout. I would include your (5) within (1). `textContent` and other DOM methods like `setAttribute` are effectively secure output-escaping on the client. Your (5a) is an excellent extra measure. In this area, I'd also add security-focused linting for (1) and (5)–e.g. for (5), to ensure secure DOM methods are used, I use Mozilla's `eslint-plugin-no-unsanitized`[0] plugin for all my personal & work projects. [0] https://github.com/mozilla/eslint-plugin-no-unsanitized/ https://github.com/mozilla/eslint-plugin-no-unsanitized/