Difference between revisions of "Abridged XSS Prevention Cheat Sheet"

From OWASP
Jump to: navigation, search
Line 51: Line 51:
 
| JavaScript Event Handler Attribute
 
| JavaScript Event Handler Attribute
 
| <input type="button" onclick="UNTRUSTED DATA" .../>
 
| <input type="button" onclick="UNTRUSTED DATA" .../>
| <ul><li>Ensure JavaScript variables are quoted</li><li>JavaScript Hex or Unicode Encoding but NO backslash encoding (\" or \' or \\) </li></ul>
+
| <ul><li>Ensure UNTRUSTED DATA is quoted</li><li>JavaScript Hex or Unicode Encoding but NO backslash encoding (\" or \' or \\) </li></ul>
 
|-
 
|-
 
| HTML Text
 
| HTML Text

Revision as of 01:39, 16 November 2011

Contents

DRAFT CHEAT SHEET - WORK IN PROGRESS

Introduction

Cross site scripting is the most common web vulnerability. It represents a serious threat because cross site scripting allows evil attacker code to run in a victim’s browser. More details about XSS can be found here: https://www.owasp.org/index.php/Cross-site_Scripting_%28XSS%29

XSS Prevention Overview

Data Type Context Code Sample Defense
String HTML Body <span>UNTRUSTED DATA</span>
String HTML Attribute, quoted <span id="UNTRUSTED DATA"></span>
  • HTML Entity Encode single and double quotes
String HTML Attribute, unquoted <span id=UNTRUSTED DATA></span>
String GET Parameter <a href="/site/search?value=UNTRUSTED DATA">clickme</a>
String Untrusted URL rendered in an HREF tag
(or other HTML link contexts)
<a href="UNTRUSTED DATA">clickme</a>
  • URL Validation
  • reject javascript: URL’s
  • Whitelist http, https and other safe URL types
  • Attribute encoding
  • safe URL verification
String CSS <div style="width: UNTRUSTED DATA;">Selection</div>
String JavaScript <script>var currentValue='UNTRUSTED DATA';</script>
  • Ensure JavaScript variables are quoted
  • JavaScript Hex Encoding
  • JavaScript Unicode Encoding
String JavaScript Event Handler Attribute <input type="button" onclick="UNTRUSTED DATA" .../>
  • Ensure UNTRUSTED DATA is quoted
  • JavaScript Hex or Unicode Encoding but NO backslash encoding (\" or \' or \\)
HTML Text HTML Body <span>UNTRUSTED HTML</span>
String DOM XSS

Output Encoding Types

Encoding Type Encoding Mechanism
HTML Entity Encoding & --> &amp;
< --> &lt;
> --> &gt;
" --> &quot;
' --> &#x27; ' is not recommended
/ --> &#x2F; forward slash is included as it helps end an HTML entity
HTML Attribute Encoding TODO
URL Encoding TODO
JavaScript HEX Encoding TODO
CSS Hex Encoding TODO

Related Articles

OWASP Cheat Sheets Project Homepage

Developer Cheat Sheets (Builder)

Assessment Cheat Sheets (Breaker)

Mobile Cheat Sheets

OpSec Cheat Sheets (Defender)

Draft Cheat Sheets

Authors and Primary Editors

Jim Manico - jim [at] owasp.org
Jeff Williams - jeff [at] aspectsecurity.com