Does OWASP Java Encoder Project escape all XSS?

StackOverflow https://stackoverflow.com/questions/21093003

  •  27-09-2022
  •  | 
  •  

Frage

Does OWASP Java Encoder Project escape all XSS? by methods

Encode.forHtmlContent(value)
Encode.forJavaScript(value)
Encode.forXml(value)

or better to use other solutions?

What OWASP solution you are advise for Java app?

War es hilfreich?

Lösung

ESAPI is no longer a flagship project for OWASP. There has been no releases since 2013, which means the project is stale.

If all you need is output escaping, use the encoder project. That one is maintained.

No single solution can be guaranteed to sanitize all XSS. You have to allow that a clever attacker might be able to exploit a bug in the HTML sanitizer.

Andere Tipps

Yes, I think if you are looking for encoding API to stop XSS then OWASP Java Encoder is best option. For context based encoding to stooping XSS, I would prefer java encoder over ESAPI

Lizenziert unter: CC-BY-SA mit Zuschreibung
Nicht verbunden mit StackOverflow
scroll top