开发者

Server side message data security

What is the best way to sanitize message content on the server side which is received from client as one of the query string parameters? This message is also meant to be resend to other connected clients so it have be secure in terms of code execution or inj开发者_Go百科ection (JavaScript or HTML) on server or client side.


To protect node.js against XSS I borrowed this from snippet jade:

/**
 * Escape the given string of `html`.
 *
 * @param {String} html
 * @return {String}
 * @api private
 */

function sanitize(html){
    return String(html)
        .replace(/&(?!\w+;)/g, '&')
        .replace(/</g, '&lt;')
        .replace(/>/g, '&gt;')
        .replace(/"/g, '&quot;');
}

P.S: You should always do proper server-side filtering


You could use node-validator, it looks like a more comprehensive solution to the aboce snippet.

0

上一篇:

下一篇:

精彩评论

暂无评论...
验证码 换一张
取 消

最新问答

问答排行榜