OWASP recommends that context-sensitive encoding needs to be done. Please help me in getting a couple of strong "code examples" on why context sensitive based encoding needs to be done and why HTML encoding alone won't help in those cases?

I know that it can help for unquoted attributes (is also explained in 2) but for now let us assume that entire world is using quoted attributes [I know its impossible but just let's assume :/], can you help me in providing two more examples where HTML encoding will not help and lead to XSS attacks which would be protected if we had used context-sensitive encoding functions provided by 3 (this is the only context sensitive encoding library present in market that I know of)?


I'm going to use a few examples where various forms of HTML encoding will not help. All of these are cases I have actually seen in practice. I will use {{foo}} for the variable to be substituted. I assume HTML encoding involves replacing < with &lt; and > with &gt;. If you also escape both single and double quotes, some of them will no longer be exploitable, but some will be.

<script>var x = '{{foo}}';</script>
<a href="{{foo}}">Clicky</a>
<script>/** Comment {{foo}} */</script>
<html ng-app='myapp'>{{foo}}</html>

You might want to check out this blog post for more details.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy