Are You Scrubbing the Twitter Stream on Your Web Site? | Hacker News Reader

Are You Scrubbing the Twitter Stream on Your Web Site?

devcentral.f5.com

5 pointslmacvittie3 comments

Just classic XSS.

However, since I am currently also writing an app that includes Tweets, can anybody recommend a good way to escape HTML in JavaScript? To my surprise I could not find a quick answer (using jQuery atm). A lot of forums recommend just replacing "<" and ">", but I feel I would have to do more research to be sure that is sufficient. For one thing this would fail within HTML attributes (for example URLs pointing to twitter users, with the name taken from the tweet). I am also not certain about character encodings.

I'd prefer to have a tried and tested library to do the escaping, even if in the end it is just a one-liner.

A simple way is to create a new element in memory and set it's text property and then retrieve it's html.

Using jQuery:

    $('<div/>').text('A & B').html();  // "A &amp; B"

Check out http://code.google.com/p/owasp-esapi-js/source/browse/trunk/...

While it may be overkill, replacing just < and > is nowhere near enough. You have to consider HTML attributes, URL's, CSS, and Javascript.

At an absolute minimum, these chars need to be encoded for the context they're rendered in:

< > ' " ( ) [ ] { }

and for good measure:

\ /

(disclaimer: any attacks that somehow bypass this (should not if done properly), would be truly unique to the application)

Reply on news.ycombinator.com