Geek Answers Handbook

XSS Attack Prevention

I create a web page where the user can interact and perform basic operations with the file system (create the / dir file, delete the / dir file, navigate the file system) on the remote computer. A web page is basic HTML (UTF-8 encoded) and Javascript. I need to make this web page proof of XSS.

Failed to avoid all non-alphanumeric characters in user input (for protection against XSS-based DSS) and file name information (for protection against stored XSS) using Javascript (this outputs six percent hexadecimal values)?

I use only alphanumeric input. Also, since I am using percentage encoded hexadecimal values, I assume that the UTF encoding vulnerability should not be present.

Can anyone think of any security loophole in this mechanism?

+5
source share
6 answers

Using javascript (this is what I think you are saying) to make escaping seems not too safe. It runs on the user's computer, and they can bypass the shielding mechanism with some effort.

What you are trying to do sounds right, but you need to do it on the server side.

+8
source

A few notes:

  • As @Alo said, this should be done on the server side so that the attacker does not bypass your javascript at all and send malicious input directly to the server. However, as you noted, this should be done (in certain situations) ALSO on the client side to prevent DOM based XSS.
  • , UTF-8, , HTTP .. UTF-7.
  • - - ? ( ...) , XSS.

HTML XSS? , .

+1

:

, GET POST, -.

, , POST.

GET, .

+1

, , , . , . , . , , , , , .

0

. - , , / /. , , .

, XSS ( "<", " > ", ";" ..), , . , , , XSS.

0

XSS . , . Tt - , , . - . , % hex . , script . script utf-8. -XSS. Google OWASP .

0
source

More articles:


All Articles