4 ms·
so you would prevent stored XSS attacks by escaping on the output step instead of the canonicalization step
by platz 5y ago
so you would prevent stored XSS attacks by escaping on the output step instead of the canonicalization step
- simonw 5y agoRight - the way to avoid XSS is to escape on output. Most good template languages these days implement auto-escaping of variables that are interpolated into HTML. You still have to be careful embedding content into non-HTML contexts. One classic example there is outputting a blob of JSON inside a <script> tag - you need to make sure that you handle the case where a string could contain "</script><script>evil_code_here()</script>".
- zelphirkalt 5y agoAlso, in languages, which do not treat HTML as a simple string (looking at PHP and many others) or have libraries for doing exactly that, using any kind of data inside any HTML element, where it is put as text, will automatically make it escaped as text, with no overhead for the developer.
- colejohnson66 5y agoReact (technically JSX) has a nice feature where all output is escaped. So this doesn't work: const evil = "<script>alert('')</script>"; .. <div>{evil}</div> That'll output: <div><script>alert('')</script></div> If you must output a raw HTML string, they make you acknowledge that you're aware of what you're doing: <div dangerouslySetInnerHTML={{__html: evil}} />