I have been looking at the usage of a XSS filter to apply across the site.
I suggest avoiding filters, at least in general. They can lead to "Ah! XSS!", "No, I was just writing an equation".
Either escape data or, if you want to allow markup, parse it and the generated DOM through a whitelist to remove unwelcome attributes, elements, URIs, etc.
Is addressing XSS at the client side sufficient enough
No! You can't trust the client.
or does it need to be addressed both on the client and on the server?
发布评论
评论（1）
我建议至少在一般情况下避免使用过滤器。它们可能会导致“啊！XSS！”、“不，我只是在写一个方程式”。
要么转义数据，要么如果你想允许标记，通过白名单解析它和生成的 DOM，以删除不受欢迎的属性、元素、URI 等。
？不！你不能相信客户。
它根本不应该在客户端处理。
I suggest avoiding filters, at least in general. They can lead to "Ah! XSS!", "No, I was just writing an equation".
Either escape data or, if you want to allow markup, parse it and the generated DOM through a whitelist to remove unwelcome attributes, elements, URIs, etc.
No! You can't trust the client.
It shouldn't be handled client side at all.