Geek asks and answers

Avoid XSS attacks when storing HTML

My site stores HTML that is generated by the user. Then, of course, this data is displayed on the web page. What are the best methods for smoothing HTML and avoiding XSS attacks? Does the tag remove <script>and <iframe>? Will it cover all browsers? I heard about old browsers displaying HTML from weird encoding ... how can I handle this?

I would like to get a general answer that does not apply to any languages ​​or technologies.

+3
source share
4 answers

You can use libraries like Jsoup , especially their whitelist-sanitizer , to prevent XSS.

, , aproach , . , HTML . , markdown.

+3

.
& ; → </; ;
↔ </; ;
> → </; GT;
" > "
‘ → &#x27;
/- > &#x2F;

0

, , . , html , , . , markdown BBcode . , StackOverflow .

, , 10 000 -.

0

You’re lost when you allow your user to install HTML on their page, there are many features like onmouseover "myEvilJS" or

0
source

More articles:


All Articles