blocks|key|3872869|text|我意识到这可能不能直接回答你的问题，但在类似情况下的ASP.NET开发人员可能会发现这一点很有用：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3872870|Microsoft+Anti-Cross+Site+Scripting+Library+V1.5|offset|length|3872871|3872872|这个库与大多数编码库的不同之处在于，它使用“包含原理”技术来提供对XSS攻击的保护。这种方法首先定义一个有效的或允许的字符集，然后对该字符集以外的任何字符(无效字符或潜在攻击)进行编码。包含方法的原理提供了对XSS攻击的高度保护，并且适用于具有高安全性要求的Web应用程序。|blockquote|3872873|3872874|entityMap|0|LINK|mutability|MUTABLE|url|http://www.microsoft.com/downloads/details.aspx?FamilyId=EFB9C819-53FF-4F82-BFAF-E11625130C25&displaylang=en^0|0|0|1C|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|S|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|T|8|@]|9|@$D|U|E|V|1|W]]|A|$]]|$1|F|3|-4|5|6|7|X|8|@]|9|@]|A|$]]|$1|G|3|H|5|I|7|Y|8|@]|9|@]|A|$]]|$1|J|3|-4|5|6|7|Z|8|@]|9|@]|A|$]]|$1|K|3|-4|5|6|7|10|8|@]|9|@]|A|$]]]|L|$M|$5|N|O|P|A|$Q|R]]]]

I realise this may not be a direct answer to your question, but ASP.NET developers in a similar situation may find this useful:

<a href="http://www.microsoft.com/downloads/details.aspx?FamilyId=EFB9C819-53FF-4F82-BFAF-E11625130C25&amp;displaylang=en" rel="nofollow noreferrer">Microsoft Anti-Cross Site Scripting Library V1.5</a>

<blockquote>
 This library differs from most encoding libraries in that it uses the "principle of inclusions" technique to provide protection against XSS attacks. This approach works by first defining a valid or allowable set of characters, and encodes anything outside this set (invalid characters or potential attacks). The principle of inclusions approach provides a high degree of protection against XSS attacks and is suitable for Web applications with high security requirements.
</blockquote>

blocks|key|5284075|text|这里有一个：http://ha.ckers.org/xss.html，但我不知道它是否完整。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|5284076|CAL9000是另一个列表，您可以在其中找到类似的内容。|5284077|entityMap|0|LINK|mutability|MUTABLE|url|http://ha.ckers.org/xss.html^0|6|S|0|0|0^^$0|@$1|2|3|4|5|6|7|N|8|@]|9|@$A|O|B|P|1|Q]]|C|$]]|$1|D|3|E|5|6|7|R|8|@]|9|@]|C|$]]|$1|F|3|-4|5|6|7|S|8|@]|9|@]|C|$]]]|G|$H|$5|I|J|K|C|$L|M]]]]

Here is one: <a href="http://ha.ckers.org/xss.html" rel="nofollow noreferrer">http://ha.ckers.org/xss.html</a> but i don't know if it's complete.

CAL9000 is another list where you could find something like that.

blocks|key|5284264|text|不确定你是否在使用PHP，但是如果是的话，你应该看看HTMLPurifer。它的使用极其简单；只需在接受输入或输出输入的位置添加一个对purify()方法的调用。它基于白名单的方法阻止了我测试过的所有XSS攻击。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|5284265|entityMap|0|LINK|mutability|MUTABLE|url|http://htmlpurifier.org/^0|1V|8|Q|B|0|0^^$0|@$1|2|3|4|5|6|7|N|8|@$9|O|A|P|B|C]]|D|@$9|Q|A|R|1|S]]|E|$]]|$1|F|3|-4|5|6|7|T|8|@]|D|@]|E|$]]]|G|$H|$5|I|J|K|E|$L|M]]]]

Not sure if you're using PHP, but if so you should look at <a href="http://htmlpurifier.org/" rel="nofollow noreferrer">HTMLPurifer</a>. It's extremely simple to use; just add a call to the <code>purify()</code> method where you accept your input, or where you output it. Its whitelist-based approach blocks every XSS attack I've tested it against.

blocks|key|5284187|text|ha.ckers.org/xss.html上的小抄不完整。我的一个同事发现了一两个不在上面的。RSnake确实列出了每个攻击字符串通过的许多正则表达式过滤器。使用一些，你可能会关闭足够的洞。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|5284188|这将是一个很好的起点。如果没有别的，那就是知道你需要寻找什么类型的东西。|5284189|使用它作为一个起点，并确保您编写的脚本有足够的转义字符，以使您的黑名单未命中的任何攻击呈现良性。如果没有浏览器呈现xss注入，xss注入有什么好处？|5284190|实际上，在这里，转义足够多的正确字符是很有意义的。要将<转换为&lt;并将“转义”转换为&quot;，很难将XSS注入脚本中。|offset|length|style|CODE|5284191|entityMap^0|0|0|0|V|4|18|6|0^^$0|@$1|2|3|4|5|6|7|N|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|O|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|P|8|@]|9|@]|A|$]]|$1|F|3|G|5|6|7|Q|8|@$H|R|I|S|J|K]|$H|T|I|U|J|K]]|9|@]|A|$]]|$1|L|3|-4|5|6|7|V|8|@]|9|@]|A|$]]]|M|$]]

The cheat sheet at ha.ckers.org/xss.html is not complete. A colleague of mine found one or two that aren't on there. RSnake does list many of the regex filters each attack string gets past. Use a few and you may close enough holes.

It would be a good starting place. If nothing else, to know what kinds of things you need to be looking for.

Use it as a place to start and make sure the scripts you write escape enough characters to make any attacks your blacklists miss rendered benign. What good is xss injection if no browser renders it?

In reality escaping enough of the right characters goes most of the way here. It's quite hard to inject XSS into a script that turns every &lt; into a <code>&amp;lt;</code> and escapes " into <code>&amp;quot;</code>.

blocks|key|5284154|text|如果你运行的是Apache，你可以使用mod_security来修复一些漏洞。至少，它将为您提供一个工具(+console或普通日志文件)来监控流量，并在为时已晚之前做出反应。此外，gotroot.com还为web应用程序制定了一些有趣的规则。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|5284155|话又说回来，我真的不知道你在填补什么样的漏洞。|5284156|entityMap|0|LINK|mutability|MUTABLE|url|http://www.modsecurity.org/|1|http://www.modsecurity.org/projects/console/index.html|2|http://gotroot.com/^0|J|C|0|1I|7|1|2J|B|2|0|0^^$0|@$1|2|3|4|5|6|7|R|8|@]|9|@$A|S|B|T|1|U]|$A|V|B|W|1|X]|$A|Y|B|Z|1|10]]|C|$]]|$1|D|3|E|5|6|7|11|8|@]|9|@]|C|$]]|$1|F|3|-4|5|6|7|12|8|@]|9|@]|C|$]]]|G|$H|$5|I|J|K|C|$L|M]]|N|$5|I|J|K|C|$L|O]]|P|$5|I|J|K|C|$L|Q]]]]

If you run Apache you could use <a href="http://www.modsecurity.org/" rel="nofollow noreferrer">mod_security</a> to close some holes. At least it would provide you with a tool (the <a href="http://www.modsecurity.org/projects/console/index.html" rel="nofollow noreferrer">console</a> or a plain logfile) to monitor the traffic and to react before it's too late. Also, <a href="http://gotroot.com/" rel="nofollow noreferrer">gotroot.com</a> has a couple interesting rules for web applications.

Then again, I don't really know what kind of holes you are closing.

blocks|key|3028361|text|您需要的是IDS+(入侵检测系统)。如果你正在使用PHP，那就有PHPIDS。它是由一个优秀的黑客社区维护和测试的。他们已经投入了各种各样的东西来改进过滤器，远远超出了Rsnake的原始列表。在某个地方也有一个.NET端口，不确定它是否还在维护。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|3028362|entityMap|0|LINK|mutability|MUTABLE|url|http://php-ids.org/^0|W|6|0|0^^$0|@$1|2|3|4|5|6|7|L|8|@]|9|@$A|M|B|N|1|O]]|C|$]]|$1|D|3|-4|5|6|7|P|8|@]|9|@]|C|$]]]|E|$F|$5|G|H|I|C|$J|K]]]]

What you want is an IDS (Intrusion detection system). If you're using PHP, there is <a href="http://php-ids.org/" rel="nofollow noreferrer">PHPIDS</a>. It's maintained and tested by an excellent hacker community. They have been throwing all kinds of things at it to improve the filters, well beyond Rsnake's original list. There was also a .NET port somewhere, not sure if it's still maintained.

As a temporary quick fix to mitigate the major risk while working on the permanent fix for XSS Vulnerability in a very large code base, I'm looking for a pre-existing XSS prevention blacklist that does a reasonable job of protecting against XSS.

Preferably a set of Regular Expressions. I'm aware of plenty of cheat sheets for testing and smoke tests etc, what I'm looking for is pre-tuned regexps for blocking the attacks.

I am fully aware that the best way is <a href="https://stackoverflow.com/questions/71328/what-are-the-best-practices-for-avoid-xss-attacks-in-a-php-site#71444">output escaping</a> or if you need some markup from users to use whitelisting. But, with the size of the code base, we need something in quick to reduce the immediate footprint of the vulnerability and raise the bar whilst working on the real solution.

Is anyone aware of a good set?

XSS Blacklist - Is anyone aware of a reasonable one?

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

教程

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云智能顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

EdgeOne AI 安全实战专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

聚焦“写作效率、视觉美观与运行性能”三方面进行全面升级，为您提供更高效、稳定的创作环境

社区富文本&Markdown编辑器全新改版上线，欢迎大家体验!

诚挚邀请您参与本次调研，分享您的真实使用感受与建议。您的反馈至关重要，感谢您的支持与参与！

社区新版编辑器体验调研

作为一个临时的快速修复，在一个非常大的代码库中永久修复XSS漏洞的同时，为了减轻主要风险，我正在寻找一个预先存在的XSS预防黑名单，它可以做一个合理的工作来防止XSS。优选地是一组正则表达式。我知道有很多用于测试和冒烟测试等的小抄，我正在寻找的是预调优的regexp来阻止攻击。我完全知道最好的方法是，或者如果你需要用户的一些标记才能使用白名单。但是，考虑到代码库的规模，我们需要一些快速的东西来减少

问XSS黑名单-有谁知道一个合理的黑名单？
EN

回答 6

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问XSS黑名单-有谁知道一个合理的黑名单？EN

回答 6

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问XSS黑名单-有谁知道一个合理的黑名单？
EN