How Do I Prevent a XSS Cross-Site Scripting Attack When Using jQueryUI Autocomplete
Posted
by theschmitzer
on Stack Overflow
See other posts from Stack Overflow
or by theschmitzer
Published on 2010-05-19T11:20:48Z
Indexed on
2010/05/19
11:50 UTC
Read the original article
Hit count: 427
I am checking for XSS vulnerabilities in a web application I am developing. This Rails app uses the h method to sanitize HTML it generates.
It does, however, make use of the jQueryUI autocomplete widget (new in latest release), where I don't have control over the generated HTML, and I see tags are not getting escaped there. The data fed to autocomplete is retrieved through a JSON request immediately before display. I
Possibilities:
1) Autocomplete has an option to sanitize I don't know about
2) There is an easy way to do this in jQuery I don't know about
3) There is an easy way to do this in a Rails controller I don't know about (where I can't use the h method)
4) Disallow < symbol in the model
Sugestions?
© Stack Overflow or respective owner
