I have an application that escapes the following special characters.
& < > " '
<script> tags. The only defense right now is escaping these 5 special characters.
What have I tried so far?
- Read the OWASP XSS Prevention cheat sheet and OWASP Filter Bypass cheatsheet.
- Tried replicating the application on my local system and tried fuzzing the application with the XSS payloads.
The OWASP cheat sheet recommends escaping
& < > " ' /if used within the HTML tags. My application's filter is missing escaping only the
/character. I believe
/is needed only if the HTML attribute is not quoted. Am I correct in understanding this?
Say, we have the following HTML code within a JSP page. Can this be bypassed when
& < > " ' /are escaped?
<input type="hidden" name="choice" value="<%= encode(req.getParameter("choice")) %>">
<div> <%= encode(req.getParameter("choice")) %> </div>
<script> document.write("<%= encode(req.getParameter("choice")) %>") </script>
I am very well aware that this is not enough, but I have tried an extensive list of XSS payloads and was not able to bypass this. Escaping these 5 characters within an HTML context seems enough to me.
I would greatly appreciate if you guys could put forward your thoughts on this. I would really love to see this filter getting bypassed.