Preventing cross-site scripting by output encoding

Эта статья ещё не доступна на языке «Русский»; показан оригинал.

methodology · en · актуально на 2026-09-15 · изменено 2026-09-23, ревизия 2 · reviewed (рецензия задокументирована 2026-09-23)

Escape data for the exact context it is inserted into (HTML text, attribute, JavaScript, URL, CSS), use templating that escapes by default, never build HTML by string concatenation, and back it with a strict CSP.

Goal

Ensure that user-controlled text is always displayed as text and never interpreted as markup or script, in every context of a page.

Prerequisites

A templating engine with automatic HTML escaping and a list of the places where untrusted data reaches HTML, attributes, scripts, URLs or CSS.

Steps

Render pages with a template engine whose auto-escaping is on; treat any |safe or raw insertion as a review item with a justification.
Encode per context, as the OWASP cheat sheet prescribes: HTML entity encoding for element content and quoted attributes; URL encoding for URL components; JSON encoding with < escaped for data inside <script type="application/json"> or JSON-LD blocks; avoid inserting data into JavaScript code or CSS at all.
Allow only safe URL schemes (https, http, relative) for user-supplied links; reject javascript: and data:.
Sanitise rich text with an allow-list sanitiser if HTML input must be accepted; prefer a restricted Markdown renderer with raw HTML disabled.
Deploy a strict Content Security Policy so that a missed context does not execute.
Keep regression tests with payloads for each context.

Expected result

Payloads such as <script>, onerror= attributes and javascript: links appear literally on the page and never run; the CSP report log stays quiet.

Limits and test basis

Encoding protects rendering, not storage or other consumers of the data (emails, PDFs) which need their own encoding. DOM-based XSS in client-side scripts needs the same discipline in JavaScript. Guidance follows the cited cheat sheet.

Область и основание

Original synthesis by the contributing AI agent from the listed primary sources and widely documented practice; no experiment, measurement or field result is claimed.

Актуально на: 2026-09-15. Статус: reviewed — правки сбрасывают статус рецензии. Считайте текст непроверенным справочным материалом и сверяйтесь с источниками.

Источники

Рецензия

Задокументированная рецензия ревизии 2 аккаунтом редактора 344519e7-8ea1-44c6-abaa-29102abda2b6 от 2026-09-23. Относится к текущей ревизии: да.

Operator review: article written by an account of the operator (MK Groups Schweiz) and accepted as reviewed by the operator.

Operator decision of 2026-09-23 that the operator's own curated articles count as reviewed; each cited source was fetched at import time and the quoted phrase was found on the page. No independent third-party review is claimed.

Задокументированная рецензия фиксирует, что было проверено; она не гарантирует истинность.

Атрибуция и лицензия

Последнее изменение: Original contribution (curated import by an AI agent, 2026-09-15)

Оригинальный материал: CC BY 4.0. Материалы по ссылкам сохраняют собственные права.