« Registry of Cloud Computing Providers' Security Controls

Updated and Improved Guidance on Use of Cookies, Etc. »

09 December 2011

News on XSS

A new edition of the OWASP Newsletter was published this week.

The December 2011 edition includes an excellent article by Gareth Heyes on protecting against cross-site scripting (XSS). He recommends a process of validating the type, whitelist checking, length validation, character restriction and context dependent output escaping, illustrating this with a number of detailed examples.

One to circulate to the development team.

Posted on: 09 December 2011 at 08:30 hrs

Comments (0) | Permalink | Send | Post to Twitter

Comments

Comments are filtered automatically and should appear shortly after they been checked.

Latest Posts

Phishing Metrics

Logging Strategically

Application Security Training and Conference

Information Security Breaches Survey 2012

OWASP London Environs AppSec Double-Bill

Security B-Sides London and Mobile Phone Apps

Discussion Activity

William E. Triest III on Common Event Expression (CEE) v0.6

Someone on Trust and E-commerce Trustmarks

Alexis on Guide to Application Security Event Logging

Someone on Cookie Spring Madness

Someone on Do This, Do That for SSL/TLS

Security Principles

confidentiality

availability

integrity

authenticity

non-repudiation

compliance

Topic Tags

about accessibility administrative aggregation architecture authentication authorisation automation availability awareness business logic caching categories classification code configuration continuity cookies corrective data protection defense design detective development disposal dns domains due diligence encoding firewalls guidelines hosting identity ids incidents information assurance infrastructure injection insurance ip addresses leakage legislation logging maturity metrics monitoring operation padss pcidss physical poisoning policies preventative privacy procedures reputation retention risks safety sdlc servers session specification sql ssl standards technical testing threats transaction traversal trust validation vulnerabilities xsrf xss

Subscribe

Subscribe to the full RSS feed or partial (summarised) RSS feed. Alternatively receive the blog via email by submitting your email address below.

Search

Clerkendweller

Colin Watson (Clerkendweller) is a chartered information technology professional, certified information systems security professional and certified information systems auditor. He is based in London as principal consultant with web security consultancy Watson Hall Ltd. More about...

Photograph of Colin Watson MSc CITP CISSP

Colin Watson also has profiles on LinkedIn and Twitter.

End notes

Please read our terms of use and obtain professional advice before undertaking any actions based on the opinions, suggestions and generic guidance presented here. Your organisation's situation will be unique and all practices and controls need to be assessed with consideration of your own business context.

The Web Security, Usability and Design blog is published by Clerkendweller under the following terms of use and privacy statement.

News on XSS

http://www.clerkendweller.com/2011/12/9/News-on-XSS

ISO/IEC 18004:2006 QR code for http://clerkendweller.com

Page http://www.clerkendweller.com/2011/12/9/News-on-XSS
Requested by 38.107.179.221 on Thursday, 17 May 2012 at 22:44 hrs (London date/time)

Please read our terms of use and obtain professional advice before undertaking any actions based on the opinions, suggestions and generic guidance presented here. Your organisation's situation will be unique and all practices and controls need to be assessed with consideration of your own business context.

Terms of use http://www.clerkendweller.com/page/terms
Privacy statement http://www.clerkendweller.com/page/privacy
© 2011-2012 clerkendweller.com