82ef171a50
* initial cut on XSS, need to add some tests still
* initial unit tests for assignment endpoints
* updating header comment license thingy
* comment, clean up
* Stubs for security unit test
* Additional Unit Testing
* isEncoded and isNotEncoded Unit Tests added
* http-proxies updates
* update for XXE solutions
* Work-around to handle special chars in action ... currently to be able to match {userId} in hint creation/assignment for IDOR
* IDOR hints updated
* mitigation content update
* mitigation content update ... 2
* Lesson Overview updates
* including restart lesson fix for lesson overview
21 lines
345 B
Plaintext
21 lines
345 B
Plaintext
== DOM-based XSS Defense
|
||
|
||
* Attacker creates url:
|
||
+
|
||
----
|
||
http://mylogin.com/login?error=<script>alert(“xss”)</script>
|
||
----
|
||
|
||
* JavaScript must enforce input validation
|
||
+
|
||
----
|
||
if ( errorMsg\[1\].match(/^[ a-zA-Z0-9:-]$/))
|
||
{
|
||
document.write(‘some error’);
|
||
}
|
||
else
|
||
{
|
||
document.write('<b>'+errorMsg\[1\]+'</b>');
|
||
}
|
||
----
|