在h：inputTextarea中阻止Html标记

I need to block Html Tags of a h:inputTextarea. The content of this textarea will be shown in an outputText with escape setted to false. It's setted to false cause i'm allowing to show links <a href...>.

我需要阻止h:inputTextarea的Html标签。此textarea的内容将显示在outputText中,其中escape设置为false。它设置为false,因为我允许显示链接。

When I click on save, it verifies the written words to check if is there a link, and if it is, we save on database with <a href...>

当我点击保存时,它会验证书面文字以检查是否有链接,如果有,我们将使用保存在数据库中

If this that i'm doing above is the wrong way to do it, let me know, but don't forget to try to help me out blocking html tags. If I'm wrong on how to do it, i'll do it later, but I need to fix this like i said it now :(

如果我上面这样做是错误的方法,请告诉我,但不要忘记尝试帮助我阻止html标签。如果我错误的怎么做,我会在以后再做,但我需要解决这个,就像我现在说的那样:(

1 个解决方案

#1

You should use some other markup language like markdown instead of HTML to prevent XSS. If you allow the a-Tag, user could still write stuff like:

您应该使用其他标记语言,如markdown而不是HTML来阻止XSS。如果您允许使用a-Tag,用户仍然可以编写如下内容:

<a href="javascript:doSomethingEvil()">foo</a>

And if you go on and try to find and filter stuff like that too, take a look at these nice examples: http://ha.ckers.org/xss.html

如果你继续尝试查找和过滤类似的东西,请看看这些漂亮的例子:http://ha.ckers.org/xss.html

EDIT: If is really the only tag, you want to allow and you just want to have clickable links, why don't you try to recognize URLs in text instead of forcing the user to write HTML? Check out this SO question.

编辑:如果真的是唯一的标签,你想允许,你只想拥有可点击的链接,为什么你不尝试识别文本中的URL而不是强迫用户编写HTML?看看这个问题。

1 个解决方案

#1

更多相关文章

随机推荐