MongoDB / Django 表单的 XSS
我正在运行 100% NoSQL 后端 (MongoDB) 并使用 Django 进行开发。我正在构建的应用程序有很多不同的表单，出于各种原因，我试图避免使用 Django.Forms，因为它们很复杂并且似乎不太灵活。
我需要多么担心 XSS（据我所知，当您使用 MongoDB 时不可能获得 SQL 注入），
因为我的大多数表单都是通过 AJAX 提交的……仅仅这样就足够了使用 Django CRSF 令牌 + 开源清理库（http://bitkickers.blogspot.com/2011/01/sanitize-html-with-beautiful-soup.html）处理所有传入数据？
不涉及将 clean_data 与 Django Forms 一起使用的问题的最佳解决方案是什么？
I am running a 100% NoSQL backend (MongoDB) and developing using Django. The application I am building has a lot of different forms, and for a variety of reasons, I am trying to avoid using Django.Forms because they are complicated and do not seem to be very flexible.
How worried do I need to be about XSS (as far as I can tell, it is not possible to get a SQL injection when you are using MongoDB)
Since most of my forms are being submitted via AJAX...is it enough to just use the Django CRSF tokens + an open source sanitizing lib (http://bitkickers.blogspot.com/2011/01/sanitize-html-with-beautiful-soup.html) with all incoming data?
What is the best solution to this problem that does not involve using cleaned_data with Django Forms?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
XSS是一个Javascript漏洞，与SQL注入无关。为了防止 XSS，无论数据如何存储，您都需要进行相同的敏感化。
根据其描述，使用该库和 CSRF 令牌应该足够了。
编辑
虽然您不需要担心 MongoDB 的 SQL 注入。如果您切换到关系数据库，您的应用程序将不再安全。针对 XSS 注入的清理并不能提供针对 SQL 注入的保护，而您提到的库则无法做到这一点。
XSS is a Javascript vulnerability, it is unrelated to SQL injection. To prevent XSS, you need to do the same sensitization, regardless of how your data is stored.
Based on its description, using that library and a CSRF token should be sufficient.
EDIT
While you do not need to worry about SQL injection with MongoDB. If you switch to a relational database, your application will no longer be secure. Sanitizing against XSS injection offers no protection against SQL injection, which the library you mention will not do.
事实上，MongoDB很容易受到 SQL 注入和 NoSQL 注入的攻击！
http://leapar.lofter.com/post/122a03_3028b0
Actually, MongoDB is vulnerable to SQL intejection as well as NoSQL injection!
http://leapar.lofter.com/post/122a03_3028b0