Recommendation¶

To guard against cross-site scripting, consider using contextual output encoding/escaping before writing user input to the page, or one of the other solutions that are mentioned in the references.

Example¶

The following example shows an exception being written directly to the document, and this exception can potentially be influenced by the page URL, leaving the website vulnerable to cross-site scripting.

functionsetLanguageOptions(){varhref=document.location.href,deflt=href.substring(href.indexOf("default=")+8);try{varparsed=unknownParseFunction(deflt);}catch(e){document.write("Had an error: "+e+".");}}

Example¶

This second example shows an input being validated using the JSON schema validatorajv, and in case of an error, the error message is sent directly back in the response.

importexpressfrom'express';importAjvfrom'ajv';letapp=express();letajv=newAjv();ajv.addSchema({type:'object',additionalProperties:{type:'number'}},'pollData');app.post('/polldata',(req,res)=>{if(!ajv.validate('pollData',req.body)){res.send(ajv.errorsText());}});

This is unsafe, because the error message can contain parts of the input. For example, the input{'<imgsrc=xonerror=alert(1)>':'foo'} will generate the errordata/<imgsrc=xonerror=alert(1)>shouldbenumber, causing reflected XSS.

References¶

• OWASP:DOM based XSS Prevention Cheat Sheet.

• OWASP:XSS (Cross Site Scripting) Prevention Cheat Sheet.

• OWASPDOM Based XSS.

• OWASPTypes of Cross-Site Scripting.

• Wikipedia:Cross-site scripting.

• Common Weakness Enumeration:CWE-79.

• Common Weakness Enumeration:CWE-116.