473,386 Members | 1,799 Online
Bytes | Software Development & Data Engineering Community
Post Job

Home Posts Topics Members FAQ

Join Bytes to post your question to a community of 473,386 software developers and data experts.

library to clean input to prevent cross site scripting

We have a javascript that is vulnerable to XSS because the input to
the script is not being checked for strings such as "javascript",
"eval", "script" etc. I have seen some snippets of code here and
there on how to check the strings but I have not yet found a
comprehensive js library that will clean user input of all offending
characters. What complicates it is that phishers can encode characters
to bypass the usual amateurish attempts to clean strings of offending
characters.

Any js libraries or resources out there anywhere?

Jun 19 '07 #1
1 2962
jamesd wrote:
We have a javascript that is vulnerable to XSS because the input to
the script is not being checked for strings such as "javascript",
"eval", "script" etc. I have seen some snippets of code here and
there on how to check the strings but I have not yet found a
comprehensive js library that will clean user input of all offending
characters. What complicates it is that phishers can encode characters
to bypass the usual amateurish attempts to clean strings of offending
characters.
http://weblogs.java.net/blog/gmurray...ting_cros.html

--
-Lost
Remove the extra words to reply by e-mail. Don't e-mail me. I am
kidding. No I am not.
Jun 19 '07 #2

This thread has been closed and replies have been disabled. Please start a new discussion.

Similar topics

13
by: Stumped and Confused | last post by:
Hello, I really, really, need some help here - I've spent hours trying to find a solution. In a nutshell, I'm trying to have a user input a value in form's textfield. The value should then be...
7
by: CJD | last post by:
Hello, I want to create a server-side object that tracks the clicks of a user while they do a task in a browser. The tasks would take place on external web sites. Since there does not seem to be...
0
by: Earl Teigrob | last post by:
I want to allow users to input html (via a rich text box) or directly, into a form field, save it in a data store and then output that html to the browser, but not allow cross-site scripting. ...
2
by: Buddy Ackerman | last post by:
I have a form into which users will enter text. I want the user to be able to enter "some" HTML however I would like to prevent "bad" HTML. The "bad" HTML would be things like <SCRIPT>, <OBJECT>,...
3
by: VB Programmer | last post by:
Using ASP.NET 2.0/SQL Express.... In places where I allow data input by users (sign up forms, comments, etc...) do I need to manually safeguard my site against vicious attacks (SQL injection,...
2
by: ra90812 | last post by:
Can someone tell me how to do cross-site scripting in AJAX. any help would be highly appreciated. Thanks, Rajesh
4
by: Jacob JKW | last post by:
Having read the CLJ FAQ and having done extensive Googling, I do understand that in in general cross-domain iframe scripting is not permitted. One issue I have not seen directly addressed, however,...
3
by: somebody | last post by:
I've been informed of a cross-site scripting vulnerability. Given the example of this exploit below, how to you prevent this from being passed to the perl cgi script myscript.cgi? Normally the...
0
by: Charles Arthur | last post by:
How do i turn on java script on a villaon, callus and itel keypad mobile phone
0
by: ryjfgjl | last post by:
If we have dozens or hundreds of excel to import into the database, if we use the excel import function provided by database editors such as navicat, it will be extremely tedious and time-consuming...
0
by: ryjfgjl | last post by:
In our work, we often receive Excel tables with data in the same format. If we want to analyze these data, it can be difficult to analyze them because the data is spread across multiple Excel files...
0
by: emmanuelkatto | last post by:
Hi All, I am Emmanuel katto from Uganda. I want to ask what challenges you've faced while migrating a website to cloud. Please let me know. Thanks! Emmanuel
0
BarryA
by: BarryA | last post by:
What are the essential steps and strategies outlined in the Data Structures and Algorithms (DSA) roadmap for aspiring data scientists? How can individuals effectively utilize this roadmap to progress...
1
by: Sonnysonu | last post by:
This is the data of csv file 1 2 3 1 2 3 1 2 3 1 2 3 2 3 2 3 3 the lengths should be different i have to store the data by column-wise with in the specific length. suppose the i have to...
0
by: Hystou | last post by:
There are some requirements for setting up RAID: 1. The motherboard and BIOS support RAID configuration. 2. The motherboard has 2 or more available SATA protocol SSD/HDD slots (including MSATA, M.2...
0
marktang
by: marktang | last post by:
ONU (Optical Network Unit) is one of the key components for providing high-speed Internet services. Its primary function is to act as an endpoint device located at the user's premises. However,...
0
by: Hystou | last post by:
Most computers default to English, but sometimes we require a different language, especially when relocating. Forgot to request a specific language before your computer shipped? No problem! You can...

By using Bytes.com and it's services, you agree to our Privacy Policy and Terms of Use.

To disable or enable advertisements and analytics tracking please visit the manage ads & tracking page.