A3:2021 | Cross Site Scripting Mitigation (4) | Cycubix Docs
XSS defense resources
Java OWASP Encoder
Do not be bothered by the incubator status on this project. Use it if you are doing Java web apps and defending against XSS. Use this link: https://www.owasp.org/index.php/OWASP_Java_Encoder_Project
General XSS prevention Cheat Sheet
link: https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
DOM XSS Prevention Cheat Sheet
link: https://cheatsheetseries.owasp.org/cheatsheets/DOM_based_XSS_Prevention_Cheat_Sheet.html
XSS Filter Evasion
Good to know your enemy …link https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet
Javascript Framework Specifics
Encoding in the client can be tricky. Here are some resources to help with that. If you do not see your framework below (e.g., Ember, React, ???) and would like to contribute or suggest something stop by https://github.com/WebGoat/WebGoat and file an issue (preferably with some recommendations/links) or fork and submit a pull request.
jQuery
be aware if you are using something like:
$selector.html(userInputHere),
you are in danger. If you want to use that, ensure you are doing something more like:
$selector.html(someEncodeHtmlMethod(userInputHere))
OR
$selector.text(someEncodeHtmlMethod(userInputHere))
If you only want the text of what is output by the user (http://stackoverflow.com/questions/9735045/is-jquery-text-method-xss-safe#9735118)
Backbone.js
(One character can make such a difference)
http://underscorejs.org/#template
https://nvisium.com/blog/2015/05/21/dont-break-your-backbone-xss-mitigation.html
Angular
Angular has sought to escape by default, but the expression language has proven to have 'sandbox' escapes. Best to check details of the version you are using and consult starting here: https://docs.angularjs.org/guide/security
Last updated