Forum Discussion

tripp-bishop's avatar
tripp-bishop
Mentor
11 years ago

Custom forms and XSS

If one needs to create a custom UI for posting comments to a blog or discussion thread what tools are available to minimize the risk of XSS attacks? I know that Freemarker ?html will prevent basic at...
  • PaoloT's avatar
    PaoloT
    11 years ago

    Hi tripp-bishop 

     

    you are also encouraged to use 

    ?js_string
?json_string

    if you are using template variables in javascript. 

     

    We also provide a couple of built in HTML stripper tools - they are documented here . If you are using AJAX endpoints or components, you also want to ensure to validate your inputs to the expected format.

     

    Hope this helps 

PaoloT's avatar
PaoloT
Lithium Alumni (Retired)
11 years ago

Hi tripp-bishop 

 

you are also encouraged to use 

?js_string
?json_string

if you are using template variables in javascript. 

 

We also provide a couple of built in HTML stripper tools - they are documented here . If you are using AJAX endpoints or components, you also want to ensure to validate your inputs to the expected format.

 

Hope this helps 

  • tripp-bishop's avatar
    tripp-bishop
    Mentor
    11 years ago

    Cheers Paolo! The utils library is exactly the kind of thing I was looking for.