Custom forms and XSS
If one needs to create a custom UI for posting comments to a blog or discussion thread what tools are available to minimize the risk of XSS attacks? I know that Freemarker ?html will prevent basic attempts but other than using a regular expression to strip tags is there anything else in the tool box available to users looking to customize their communities?
Hi tripp-bishop
you are also encouraged to use
?js_string ?json_string
if you are using template variables in javascript.
We also provide a couple of built in HTML stripper tools - they are documented here . If you are using AJAX endpoints or components, you also want to ensure to validate your inputs to the expected format.
Hope this helps
