跨站脚本和 HTML 编码
如果我在重新显示网站用户输入的任何数据时对其进行 HTML 编码，这是否可以防止 CSS 漏洞？
另外，是否有可用的工具/产品可以为我清理用户输入，这样我就不必编写自己的例程。
If I HTML encode any data entered by website users when I redisplay it, will this prevent CSS vulnerabilities?
Also, is there a tool/product available that will sanitize my user input for me, so that I don't have to write my own routines.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
这个问题有很多微妙之处，但总体答案是肯定的。
您网站的安全性很大程度上取决于您放置数据的位置。 如果你把它当成合法文本，攻击者基本上就没有办法执行XSS。 如果将其放入属性中，如果忘记转义引号或不检查多字节格式良好性，则可能会受到攻击。 如果将其放入 JSON 变量中，未正确转义可能会导致任意 JavaScript。 等等。上下文非常重要。
其他用户建议使用 XSS 删除或 XSS 检测功能。 我倾向于认为 XSS 删除对用户不友好； 如果我发布一个电子邮件地址，例如 <[电子邮件受保护]> 并且您的删除 XSS 函数认为它是 HTML 标记，此文本神秘地消失了。 如果我正在运行 XSS 讨论论坛，我不希望人们的示例代码被删除。 检测更明智一些； 如果您的应用程序可以判断有人正在攻击它，它就可以禁止该 IP 地址或用户帐户。 但是，您应该小心使用此类功能； 无辜者可能并且将会陷入交火。
验证是网站逻辑的重要组成部分，但它也独立于转义。 如果我不验证任何内容而只是转义所有内容，则不会出现 XSS 攻击，但有人可以说他们的生日是“音乐消逝的那一天”，应用程序也不会变得更明智。 理论上，对某些数据类型进行足够严格的验证可以执行转义的所有职责（例如数字、枚举等），但无论如何，深度防御通常都是很好的做法。 即使你是 100%，它也是一个整数。 可能不是。
转义明文是一个微不足道的问题； 如果您的语言没有提供函数，请使用字符串替换
<、>、"、' 和&及其相应的 HTML 实体就可以解决问题（仅当您不使用 UTF-8 时才需要其他 HTML 实体）。它自己的堆栈溢出问题。There are various subtleties to this question, although the answer in general is yes.
The safety of your website is highly dependent on where you put the data. If you put it as legit text, there is essentially no way for the attacker to execute XSS. If you put it in an attribute, if you forget to escape quotes or don't check for multibyte well-formedness, you have a possible attack. If you put it in a JSON variable, not escaping properly can lead to arbitrary JavaScript. Etc. etc. Context is very important.
Other users have suggested using XSS removal or XSS detection functions. I tend to think of XSS removal as user unfriendly; if I post an email address like <[email protected]> and your remove XSS function thinks it's an HTML tag, this text mysteriously disappears. If I am running an XSS discussion forum, I don't want people's sample code to be removed. Detection is a little more sensible; if your application can tell when someone is attacking it, it can ban the IP address or user account. You should be careful with this sort of functionality, however; innocents can and will get caught in the crossfire.
Validation is an important part of website logic, but it's also independent of escaping. If I don't validate anything but escape everything, there will be no XSS attacks, but someone can say that their birthday is "the day the music died", and the application wouldn't be the wiser. In theory, strict enough validation for certain data types can perform all the duties of escaping (think numbers, enumerations, etc), but it's general good practice of defense in depth to escape them anyway. Even if you're 100% it's an integer. It might not be.
Escaping plaintext is a trivial problem; if your language doesn't give you a function, a string replace for
<,>,",'and&with their corresponding HTML entities will do the trick. (You need other HTML entities only if you're not using UTF-8). Allowing HTML tags is non-trivial, and merits its own Stack Overflow question.对 HTML 进行编码只是一个开始……它并不能防止所有 XSS 攻击。
如果您使用 PHP，这里有一个可以在您的网站中使用的好函数：Kallahar 的 RemoveXSS() 函数
如果您不使用 PHP，至少代码有很好的注释，解释了每个部分的目的，然后可以适应另一种编程语言。
encoding your HTML is a start... it does not protect from all XSS attacks.
If you use PHP, here is a good function you can use in your sites: Kallahar's RemoveXSS() function
If you don't use PHP, at least the code is well commented, explaining the purpose of each section, and could then be adapted to another programming language.
答案是否定的，编码还不够。 XSS 的最佳保护是将所有传入数据的“白名单”验证与所有输出数据的适当编码相结合。 验证允许检测攻击，编码可防止任何成功的脚本注入在浏览器中运行。 如果您使用 .NET，您可以检查此库 http://msdn.microsoft .com/en-us/library/aa973813.aspx
您还可以检查一些备忘单来测试您的保护：http://ha.ckers.org/xss.html
问候，
维克多
The answer is no, encoding is not enought. The best protection for XSS is a combination of "whitelist" validation of all incoming data and appropriate encoding of all output data. Validation allows the detection of attacks, and encoding prevents any successful script injection from running in the browser. If you are using .NET you can check this library http://msdn.microsoft.com/en-us/library/aa973813.aspx
You can check also some Cheat sheets to test your protections: http://ha.ckers.org/xss.html
Regards,
Victor
HtmlEncoding 输入不允许 HTML 呈现到页面上，从而为您提供了很大的帮助。
根据您的语言，那里应该存在一些项目来清理数据。 在 .NET 中，您可以使用 Server.HtmlEncode(txtInput.Text) 从名为 txtInput 的文本框输入数据。
正如其他人提到的，需要更多的物品才能得到真正的保护。
HtmlEncoding input gets you a good portion of the way by not allowing the HTML to render to the page.
Depending on your language items should exist there to sanitize the data. In .NET you can use Server.HtmlEncode(txtInput.Text) to input data from a textbox named txtInput.
As others have mentioned more items are needed to be truly protected.