1

I have a tiny application and I've read a lot about XSS, so I want to sanitize the one input that I have.

When googling, I came across the OWASP guide stating that the following should be used to correctly sanitize the input:

String safe = ESAPI.encoder().encodeForJavaScript( request.getParameter( "input" ) );

I'm quite new to coding so I copy/pasted it to my JavaScript function and doesn't appear to be working.

A rough representation of what I'm trying to do is executable here, the code:

<input name="this" type="text" maxlength="16" id="this" />
<button onclick="run()">run</button>

<script>
function run() {

// how I used to do it
// a = document.getElementById("this").value;

safe = ESAPI.encoder().encodeForURL( document.getElementById("this").value );

alert(safe);
}

</script>

Valid characters for my applications are only the numbers [0-9] and a dot (.).

How do I correctly escape/sanitize an input field in JavaScript to prevent XSS attacks.

4

I'm quite new to coding so I copy/pasted it to my JavaScript function and doesn't appear to be working.

It might not be working because ESAPI is a library you have to reference in an HTML script tag; it isn't part of core javascript that comes with the browser. ESAPI seems to be available from github, which also contains a README.md file that explains how to load it in HTML. May you missed that part? Your question doesn't say.

Also, note that it should be

var safe = ....

not just

safe = ....

This is important in javascript. You don't want to create global variables and pollute the global namespace if you can help it.

Valid characters for my applications are only the numbers [0-9] and a dot (.).

In that case, I'd suggest you use a javascript regular expression to see if your input matches these characters, and show an error message if it doesn't. ESAPI seems to be overkill for that. Validating "known good" input is much safer than trying to think of all problematic inputs and removing/transforming that via a sanitation routine. Do something like that:

var validationRegex = new RegExp('^[0-9.]+$');
var text = document.getElementById("this").value;
if (text.match(validationRegex)) { }; // do something when text matches

I don't have all that much javascript experience, so you might want to read up on how regular expressions work in javascript to doublecheck that code. Take care with the dot character - outside of [ ], it stands for "any character except newline" in regular expressions.

Finally, if you're sending your extracted input field data to a server (I'm cleverly assuming that you don't just want to output the data via alert(safe) - in which case you wouldn't need to sanitize it in the first place), it would be much better to sanitize the data on the server, because there you can trust the sanitation. If you sanitize on the client, a malicious user might still send your server unsanitized data.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.