82ef171a50
* initial cut on XSS, need to add some tests still
* initial unit tests for assignment endpoints
* updating header comment license thingy
* comment, clean up
* Stubs for security unit test
* Additional Unit Testing
* isEncoded and isNotEncoded Unit Tests added
* http-proxies updates
* update for XXE solutions
* Work-around to handle special chars in action ... currently to be able to match {userId} in hint creation/assignment for IDOR
* IDOR hints updated
* mitigation content update
* mitigation content update ... 2
* Lesson Overview updates
* including restart lesson fix for lesson overview
25 lines
637 B
Plaintext
25 lines
637 B
Plaintext
== XSS Defense
|
||
* HTML entity input encoding
|
||
** Converting ‘<‘ and ‘>’ to < and > before storage
|
||
* HTML entity output encoding
|
||
** Converting ‘<‘ and ‘>’ to < and > before writing
|
||
* Input validation
|
||
** Positive model to allow valid characters only
|
||
** New attacks found everyday
|
||
*** negative filter not reliable
|
||
* Setting HTTPOnly as a cookie attribute
|
||
* Only allow post data to prevent reflected XSS
|
||
* Use language specific built-in mechanisms
|
||
** Page validation for .NET in web.config
|
||
+
|
||
----
|
||
<%page ValidateRequest="true" %>
|
||
----
|
||
** Struts
|
||
+
|
||
----
|
||
<bean:write ... >
|
||
----
|
||
|
||
*Any problems with these approaches?*
|