Javascript 注入预防：从哪里开始？
我正在开发一个新网站（ASP.NET、Web 窗体、C#），并且需要包含针对 Javascript 注入攻击的保护。有没有人有任何关于如何实施安全站点以抵御此类攻击的良好链接？
谢谢
I'm working on a new web site (ASP.NET, Web Forms, C#) and need to include protection against Javascript injection attacks. Does anyone have any good links for how to implement a site secure against these types of attacks?
Thanks
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
您需要对从客户端读取的任何内容部署适当的输入验证。
OWASP 对此有一个很好的总结：
https://www.owasp.org/index.php/ Input_Validation_Cheat_Sheet
基本上，您需要建立一个白名单（通常是用户应该能够发送/提交到您的应用程序的所有内容的一些正则表达式），然后只接受白名单。一个好的做法是这样做，但在白名单前面扔一个黑名单基本上，寻找已知的坏东西，例如Javascript脚本标签，并拒绝它们（这是黑名单部分）。然后传递经过那里的内容，以确保您应该看到并且可以安全地处理内容，并且仅在存在时才允许它。
You need to deploy proper input valdiation on anything you read in from your clients.
OWASP has a great summary of this here:
https://www.owasp.org/index.php/Input_Validation_Cheat_Sheet
Basically, you're going to want to build up a whitelist (normally some regexs for everything that users should be able to sent/submit to your application) and then only accept the whitelist. A good practice is to do this, but throw a blacklist in front of the whitelist Basically, look for known-bad things like Javascript script tags, and reject them (this is the blacklist part). Then pass what got though there to make sure content that you should be seeing and can safely handle and only allow it though if it is.
跨站脚本攻击 (XSS) 是您关注的漏洞的名称。 在 OWASP 上阅读并咨询他们的XSS 预防备忘单
当您在那里时，浏览一下他们的十大最常见的 Web 应用程序漏洞，并考虑您需要保护自己免受的其他攻击/弱点。
Cross-site scripting (XSS) is the name of the vulnerability you are concerned about. Read up on it at OWASP and consult their XSS Prevention Cheat Sheet
While you are there, have a browse through their Top Ten most common web application vulnerabilities and consider other attacks/weaknesses you need to protect yourself from.