blocks|key|649386|text|使用javascript+(我想这就是你所说的)来进行转义似乎不太安全。它在用户的机器上运行，他们可以通过一些努力绕过转义机制。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|649387|你想做的听起来是对的，但是你需要在服务器端去做。|649388|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|F|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|G|8|@]|9|@]|A|$]]|$1|D|3|-4|5|6|7|H|8|@]|9|@]|A|$]]]|E|$]]

Using javascript (Which is what I think is you're saying) to do the escaping doesn't seem too secure. It runs on the users machine and they could, with some effort bypass the escaping mechanism.

What you're trying to do sounds right, but you need to do it server-side.

blocks|key|113850|text|需要注意的几点：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|113851|113852|正如@Alo所说，这应该在服务器端完成，以防止攻击者完全绕过您的javascript并将恶意输入直接发送到服务器。然而，正如你所提到的，这(在某些情况下)也应该在客户端完成，以防止基于DOM的attacks.|unordered-list-item|113853|Spaces。|113854|你提到页面是UTF8的，你需要使用元标签，HTTP头等来强制执行这一点。(有些包括...)在某些情况下，只需使用一个空格和字母，就可以安装一个全面的XSS攻击。|113855|113856|查看我对Will+HTML+Encoding+prevent+all+kinds+of+XSS+attacks?的回答中的更多信息，你会在那里找到你需要知道的所有信息。|offset|length|113857|entityMap|0|LINK|mutability|MUTABLE|url|https://stackoverflow.com/questions/53728/will-html-encoding-prevent-all-kinds-of-xss-attacks/70222#70222^0|0|0|0|0|0|0|4|1G|0|0^^$0|@$1|2|3|4|5|6|7|W|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|X|8|@]|9|@]|A|$]]|$1|C|3|D|5|E|7|Y|8|@]|9|@]|A|$]]|$1|F|3|G|5|E|7|Z|8|@]|9|@]|A|$]]|$1|H|3|I|5|E|7|10|8|@]|9|@]|A|$]]|$1|J|3|-4|5|6|7|11|8|@]|9|@]|A|$]]|$1|K|3|L|5|6|7|12|8|@]|9|@$M|13|N|14|1|15]]|A|$]]|$1|O|3|-4|5|6|7|16|8|@]|9|@]|A|$]]]|P|$Q|$5|R|S|T|A|$U|V]]]]

A few point of note:

<ul>
<li>As @Alo said, this should be done server-side, to prevent an attacker from bypassing your javascript altogether and sending the malicious input directly to the server. However, as you noted, this should be done (in certain situations) ALSO on the client-side, to prevent DOM-based XSS.</li>
<li>You mentioned that the page is UTF-8, you need to enforce this using meta tags, HTTP headers, etc. Otherwise, you're vulnerable to UTF-7 attacks.</li>
<li>Spaces - is that conisdered alphanumeric, or not? (some include that...) Using just a space and letters, a fullblown XSS attack CAN be mounted, in some situations. </li>
</ul>

Check out some more info in my answer to <a href="https://stackoverflow.com/questions/53728/will-html-encoding-prevent-all-kinds-of-xss-attacks/70222#70222">Will HTML Encoding prevent all kinds of XSS attacks?</a> You'll find all you need to know there.

blocks|key|658208|text|补充其他观点的注意事项：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|658209|确保正确使用GET和POST，因为这是许多网站上最简单的安全漏洞。|658210|如果用户输入将触发对数据库的任何更改，请确保使用POST。|658211|如果要检索要显示的信息，则仅限user+GET。|658212|entityMap^0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|J|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|K|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|L|8|@]|9|@]|A|$]]|$1|F|3|G|5|6|7|M|8|@]|9|@]|A|$]]|$1|H|3|-4|5|6|7|N|8|@]|9|@]|A|$]]]|I|$]]

A note to supplement other points made:

Make sure you are using GET and POST correctly, because that is the simplest kind of security hole on many websites.

If user input is going to trigger any change to the database, make sure you use POST.

Only user GET if you are retrieving information to be displayed.

blocks|key|2561945|text|这听起来很安全，而且很可能是安全的，但这其中有一个问题。只有当你正确地实现它时，它才能起作用。这太容易出错了。如果你想这样做，那没问题，但我建议你使用一些已经测试过的库来做这件事，而不是使用你自己的库。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2561946|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

This sounds secure, and probably is, but there is a catch. It only works if you implement it correctly. It's just way too easy to get wrong. If you want to go for it, that's okay, but I would suggest using some already tested libraries to do this, rather than rolling your own.

blocks|key|3893252|text|编码是很好做的。最大的潜在风险是您如何处理数据以及数据是否/何时被解码/显示。如果您解码用户输入并显示它，解码数据，那么在这一点上您可能会遇到问题。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3893253|如果您不迫切需要支持在潜在XSS漏洞方面风险更高的字符(如'<‘、'>’、';‘等)那么我认为将这些字符列入黑名单也是合理的。这样，在解码和显示数据时，就不会潜在地表达XSS问题。|3893254|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|F|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|G|8|@]|9|@]|A|$]]|$1|D|3|-4|5|6|7|H|8|@]|9|@]|A|$]]]|E|$]]

Encoding is good to do. The biggest potential risk is what you do with the data and if/when the data is decoded/displayed. If you decode the user input and display it, decoding the data, then you may have issues at that point. 

If you have no pressing need to support characters that are more risky in terms of potential XSS vulnerabilities (such as '&lt;', '>', ';', etc.) then I think it is reasonable to blacklist those characters as well. That way, in the event you decode and display data, you won't potentially express an XSS issue.

blocks|key|2569391|text|防御XSS的基本方法是尽可能使用正则表达式来验证输入，并对所有输出进行编码。对输出进行编码可能比较棘手，因此最好使用库。对于你的应用程序，至少有一个重要的输入是文件名，所以你需要一个正则表达式来匹配你的目标操作系统的任何有效的文件名。只接受字母数字输入将使您的应用程序无法在常见操作系统上处理许多文件名。我不明白为什么使用%25十六进制值会有任何好处。恶意脚本没有理由不能以这种方式编码。同一脚本可以有许多有效的utf-8表示。您需要对反XSS编码实践做更多的背景阅读。谷歌OWASP以供参考。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2569392|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

The basic way to defend against XSS is to use regular expressions to validate input whenever possible and to encode all output. Encoding output can be tricky, so it is best to use a library. Tt least one important input to your application is filenames, so you would want a regular expression that would match any valid filename for your target OS. Accepting only alphanumeric input would make it impossible for your app to handle many filenames on common operating systems. I don't follow why using %hex values would do any good. There's no reason a malicious script can't be encoded that way. The same script can have many valid utf-8 representations. You need to do some more background reading on anti-XSS coding practices. Google OWASP for references.

I am creating a webpage where the user can interact and perform basic filesystem operations(create file/dir, delete file/dir, navigate filesystem) on a remote computer.
The webpage is basic HTML(UTF-8 encoding) and Javascript. I need to make this webpage XSS proof.

Would escaping all non-alphanumeric chars in user input(to protect against DOM based XSS) and filename info(to protect against stored XSS) using Javascript(this outputs percent-encoded hex values) suffice?

I am essentially whitelisting only the alphanumeric input. Also, since I am using percent encoded hex values, I am assuming the UTF encoding vulnerability should not be present.

Can anyone think of any security loophole in this mechanism?

Preventing XSS attacks

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

教程

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云智能顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云AI代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

功能1上新10个字符

功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符。

功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符。

功能5描述100个字符功能5描述100个字符功能5描述100个字符功能5描述100个字符功能5描述100个字符功能5描述100个字符

功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符

功能4上新

文章&问答评论现已支持表情

全新交互，全新视觉，新增快捷键、悬浮工具栏、高亮块等功能并同时优化现有功能，全面提升创作效率和体验

社区富文本编辑器全新改版！诚邀体验～ 

精选全网热门MCP server，让你的AI更好用 🚀

💥开发者 MCP广场重磅上线！

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

聚焦“写作效率、视觉美观与运行性能”三方面进行全面升级，为您提供更高效、稳定的创作环境

社区富文本&Markdown编辑器全新改版上线，欢迎大家体验!

诚挚邀请您参与本次调研，分享您的真实使用感受与建议。您的反馈至关重要，感谢您的支持与参与！

社区新版编辑器体验调研

我正在创建一个网页，用户可以在其中交互并在远程计算机上执行基本的文件系统操作(创建文件/目录、删除文件/目录、导航文件系统)。网页是基本的HTML(UTF-8编码)和Javascript。我需要使这个网页XSS证明。使用Javascript(这将输出百分比编码的十六进制值)转义用户输入中的所有非字母数字字符(以防止基于DOM的XSS)和文件名信息(以防止存储的XSS)就足够了吗？我基本上只将字母数

问防止XSS攻击
EN

回答 6

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问防止XSS攻击EN

回答 6

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问防止XSS攻击
EN