How to prevent cross-site-scripting and XSS?
We are getting messages from unknown users like the below:
[
<img src=x onerror=prompt('xss by codejump');>
<img src=x onerror=prompt(/securitytesting/)>
]
How to resolve this error?
How to add error validations to the Rich text area of TinyMce editor?
Thanks in advance,
Sateesh.
sateesh999, You can use auto-escaping and output formats for XSS in freemarker.
See guides in this link
https://freemarker.apache.org/docs/dgui_misc_autoescaping.html
Thank you, Prashanth.
I will check with the given guides in the below link and let you know if I need any help.
https://freemarker.apache.org/docs/dgui_misc_autoescaping.html
Regards,
Sateesh.
sateesh999 do you have any idea how these messages are posted? TinyMCE does not allow any inline JS eventhandlers, they get stripped... try to post your above code, it doesn't work... but maybe if you get these messages posted via API, they are not sanitized...just a suspicion...
