javascript - How to prevent XSS vulnerability from being introduced when using .val()? -

-


javascript - How to prevent XSS vulnerability from being introduced when using .val()? -

i store unsanitized user input in database, escape on output.

if come in "><svg/onload=alert(3)> input , save in database, load page escapes data, putting input, page source shows:

... value="&quot;&gt;&lt;svg/onload=alert(3)&gt;" ...

as can see, it's escaped.

however, if run code:

$(".somediv").html($("#myinput").val());

then next set element:

""><svg/onload=alert(3)>"

and alert box pops up.

jsfiddle

what doing wrong here? thought escaping info on output needed do, apparently when manipulating dom jquery that's not true.

if want set text, utilize .text(). entities in attribute’s value interpreted, , ""><svg/onload=alert(3)>" is value of attribute.

$(".somediv").text($("#myinput").val());

class="snippet-code-js lang-js prettyprint-override">$('#destination').text($('#source').attr('title')); class="snippet-code-html lang-html prettyprint-override"><script src="https://ajax.googleapis.com/ajax/libs/jquery/2.1.1/jquery.min.js"></script> <div id="source" title="&amp;&quot;&lt;">hover on me!</div> <div id="destination"></div>

javascript jquery html xss

Comments

Post a Comment

Popular posts from this blog

Using Android Volley to post an array to PHP -

-
Using Android Volley to post an array to PHP - this how post values volley: @override protected map<string, string> getparams() { jsonobject jsonobjectmembers=new jsonobject(); (int i=0; i<arr_added_userids.size(); i++) { seek { jsonobjectmembers.put("params_"+i,arr_added_userids.get(i)); } grab (jsonexception e) { e.printstacktrace(); } } map<string, string> params = new hashmap<string, string>(); params.put("host", session_userid); params.put("params",jsonobjectmembers.tostring()); homecoming params; } this tried: foreach($_post['params'] $key => $value) { seek { $stmt = $conn->prepare("insert crewmembers (crewid, member) values (:crewid, :member)"); $query_params = array( ':crewid' => $crewid, ':member' => $value ); ...
Read more

python - How to add an model instance to a django queryset? -

-
python - How to add an model instance to a django queryset? - it seems django queryset behaves somehow python list. but doesn't back upwards list's .append() method know. what want like: from my_django_app.models import mymodel queryset = mymodel.objects.none() queryset.append(mymodel.objects.first()) ## no list's .append() method! is there way add together model instance existing queryset? no. queryset representation of query - hence name - not arbitrary collection of instances. if need actual queryset rather list, seek accumulating ids of objects need , getting objects via __in query: list_of_ids = [] list_of_ids.append(my_id) ... queryset = mymodel.objects.filter(id__in=list_of_ids) this isn't efficient, though. python django
Read more

angularjs - No 'Access-Control-Allow-Origin' error from local domain to public API -

-
angularjs - No 'Access-Control-Allow-Origin' error from local domain to public API - i'm trying create app retrieve stock name, asking , purchase cost yahoo finance api, using restangular. i'm having problem accessing public api in local application i'm creating when request. url parameters i'm sending: http://finance.yahoo.com/d/quotes.csv?s=msft+ge&f=nab using postman, request returns array contains stock name, asking cost , purchase cost of stock. doing request in postman returns desired info without errors. when request in local, next error: xmlhttprequest cannot load http://finance.yahoo.com/d/quotes.csv?s=msft+ge&f=nab. no 'access-control-allow-origin' header nowadays on requested resource. origin 'http://localhost' hence not allowed access. the html code follows: <html ng-app="app"> <head> <title>restangular</title> <script src="https://ajax.googleapis.com/ajax/li...
Read more