Difference between revisions of "CRV2 ContextEncHTMLEntity"

From OWASP
Jump to: navigation, search
Line 5: Line 5:
 
     HTML Body Context
 
     HTML Body Context
 
      
 
      
     <span>UNTRUSTED DATA</span>
+
     <nowiki><span>UNTRUSTED DATA</span></nowiki>
 
     OR
 
     OR
 
     <body>...UNTRUSTED DATA </body>
 
     <body>...UNTRUSTED DATA </body>

Revision as of 09:37, 3 October 2013

HTML elements which contain user controlled data or data from untrusted sourced should be reviewed for contextual output encoding. In the case of HTML entities we need to help ensure HTML Entity Encoding is perfromed:

Example HTML Entity containing untrusted data:

   HTML Body Context
   
   <span>UNTRUSTED DATA</span>
   OR
   <body>...UNTRUSTED DATA </body>
   OR
   <div>UNTRUSTED DATA </div>
   

HTML Entity Encoding is required

   & --> &amp;
   < --> &lt;
   > --> &gt;
   " --> &quot;
   ' --> &#x27;