# A3:2021 | Cross Site Scripting Mitigation (4) | Cycubix Docs

### XSS defense resources <a href="#xss_defense_resources" id="xss_defense_resources"></a>

#### Java OWASP Encoder <a href="#java_owasp_encoder" id="java_owasp_encoder"></a>

Do not be bothered by the incubator status on this project. Use it if you are doing Java web apps and defending against XSS. Use this link: [https://www.owasp.org/index.php/OWASP\_Java\_Encoder\_Project](https://www.owasp.org/index.php/OWASP_Java_Encoder_Project)

#### General XSS prevention Cheat Sheet <a href="#general_xss_prevention_cheat_sheet" id="general_xss_prevention_cheat_sheet"></a>

link: [https://cheatsheetseries.owasp.org/cheatsheets/Cross\_Site\_Scripting\_Prevention\_Cheat\_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)

#### DOM XSS Prevention Cheat Sheet <a href="#dom_xss_prevention_cheat_sheet" id="dom_xss_prevention_cheat_sheet"></a>

link: [https://cheatsheetseries.owasp.org/cheatsheets/DOM\_based\_XSS\_Prevention\_Cheat\_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/DOM_based_XSS_Prevention_Cheat_Sheet.html)

#### XSS Filter Evasion <a href="#xss_filter_evasion" id="xss_filter_evasion"></a>

Good to know your enemy …​link [https://www.owasp.org/index.php/XSS\_Filter\_Evasion\_Cheat\_Sheet](https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet)

#### Javascript Framework Specifics <a href="#javascript_framework_specifics" id="javascript_framework_specifics"></a>

Encoding in the client can be tricky. Here are some resources to help with that. If you do not see your framework below (e.g., Ember, React, ???) and would like to contribute or suggest something stop by [https://github.com/WebGoat/WebGoat](https://github.com/WebGoat/WebGoat) and file an issue (preferably with some recommendations/links) or fork and submit a pull request.

**jQuery**

be aware if you are using something like:

_$selector.html(userInputHere)_,

you are in danger. If you want to use that, ensure you are doing something more like:

_$selector.html(someEncodeHtmlMethod(userInputHere))_

OR

_$selector.**text**(someEncodeHtmlMethod(userInputHere))_

If you only want the text of what is output by the user ([http://stackoverflow.com/questions/9735045/is-jquery-text-method-xss-safe#9735118](http://stackoverflow.com/questions/9735045/is-jquery-text-method-xss-safe#9735118))

**Backbone.js**

(One character can make such a difference)

[http://underscorejs.org/#template](http://underscorejs.org/#template)

[https://nvisium.com/blog/2015/05/21/dont-break-your-backbone-xss-mitigation.html](https://nvisium.com/blog/2015/05/21/dont-break-your-backbone-xss-mitigation.html)

**Angular**

Angular has sought to escape by default, but the expression language has proven to have 'sandbox' escapes. Best to check details of the version you are using and consult starting here: [https://docs.angularjs.org/guide/security](https://docs.angularjs.org/guide/security)
