d34e1f86dd
* Move metadata * Move message * Add text * Clarify text * Reword method to property in context of innerHTML
8 lines
712 B
Plaintext
8 lines
712 B
Plaintext
==== The limits of validation
|
|
|
|
Validation of user inputs is a good practice to protect against various injection attacks. But for XSS, validation on its own is not the recommended approach.
|
|
|
|
For example, filtering out user inputs based on a denylist will never fully prevent XSS vulnerabilities from being exploited. This practice is sometimes used by web application firewalls. Time and time again, malicious users are able to find the exploitation payload that will defeat the filters of these firewalls.
|
|
|
|
Another common approach is to parse HTML and strip sensitive HTML tags. Again, this denylist approach is vulnerable by design: maintaining a list of sensitive HTML tags is very difficult in the long run.
|