JavaScript-based X/HTML & CSS sanitization
Before everyone tells me that I shouldn\'t do client-side sanitization (I do in fact intend to do it on a client, though it could work in SSJS as well), let me clarify what
-
The purpose of the ESAPI is to provide a simple interface that provides all the security functions a developer is likely to need in a clear, consistent, and easy to use way. The ESAPI architecture is very simple, just a collection of classes that encapsulate the key security operations most applications need.
JavaScript version of OWASP ESAPI: http://code.google.com/p/owasp-esapi-js
Input validation is extremely difficult to do effectively, HTML is easily the worst mashup of code and data of all time, as there are so many possible places to put code and so many different valid encodings. HTML is particularly difficult because it is not only hierarchical, but also contains many different parsers (XML, HTML, JavaScript, VBScript, CSS, URL, etc...). While input validation is important and should always be performed, it is not a complete solution for injection attacks. It's better to use escaping as your primary defense. I haven't used HTML Purifier before but it looks good and they certainly have put a lot of time and thought into it. Why not use their solution server side first, then apply any additional rules you'd like after that. I've seen some hacks that use nothing but combinations of
[ ] ( )to write code with. 100s of more examples here XSS (Cross Site Scripting) Cheat Sheet and The Open Web Application Security Project (OWASP). Some things to watch out for DOM based XSS Prevention Cheat Sheet.HTML Purifier catches this mixed encoding hack
XSSAnd this DIV background-image with unicoded XSS exploit
A bit of what you're up against: all 70 possible combinations of the character "<" in HTML and JavaScript
< %3C < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < \x3c \x3C \u003c \u003C讨论(0)
加载中...
- 热议问题