I was wondering - Say for example you have a legacy application that is XSS vulnerable - are there any (hopefully client side) libraries that can catch and manipulate all outputs that the server returns and potentially encode them? (or any other method than going around every line of code and encoding/decoding the data.

Client side is pure javascript, i'm trying to find "quick" fixes instead of re-writing and changing my client side library to other languages (like angular) that handle those issues automatically.

  • I'll edit my question - the javascript client side is currently pure javascript, i'm looking for quicker fixes than re-writing everything in angular for example
    – ArielB
    Commented Jul 16, 2018 at 10:19
  • There are also solutions if you use ECMAScript 6 . Check out: wesbos.com/sanitize-html-es6-template-strings
    – Pilfility
    Commented Jul 16, 2018 at 10:24

1 Answer 1


It depends very much on the client side code as to whether this is possible. For a single page app, where only standard framework code is loaded from the server directly, then client side calls are used to pull any other required data, it's trivial - just hook into the client side calls, and ensure they're parsed correctly before being used on the page.

However, in a lot of older applications, the server provides the data directly, even if it is then shifted into place with client side code. In this case, any client side encoding would only trigger after the content has been put on the page, and, probably, executed.

Example of SPA (pseudocode):

    clientContent = server.load(serverContent);
    document.body = clientContent; // raw content only included after encoding

Example of server rendered:

    serverContent // raw content executes here

In terms of methods of encoding, it depends on the context of the vulnerable data - for HTML contexts, look at things like https://stackoverflow.com/a/7124052/6039613 but note that you will need different characters escaping if the XSS vulnerabilities are within script blocks, for example.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .