Safe vs Unsafe jQuery Methods
We all know XSS is bad and we all use jQuery, unfortunately its API doc doesn't do a very good job explaining what jQuery methods are safe to use for unescaped input, and which are not.
Safe
.text()-
.attr()// still needs to be careful when used in anhref .prop().val()
Unsafe
$("html code").html().append*().insert*().prepend*().wrap*().before().after()
Written by Jimmy Yuen Ho Wong
Related protips
4 Responses
I wouldn't consider .attr as a safe method. Example: .attr('href', 'javascript:alert()')
over 1 year ago
·
Good call!
over 1 year ago
·
Superb post, thank you for this!
over 1 year ago
·
Can you please show an example of the XSS safe DOM insertion. Would it be:
jQuery('<div/>', {
id: 'foo',
href: 'http://google.com',
title: 'Become a Googler',
rel: 'external',
text: 'Go to Google!'
}).appendTo('#mySelector');?
Thank you
over 1 year ago
·
Have a fresh tip? Share with Coderwall community!
Post
Post a tip
Best
#Jquery
Authors
Did you know?
JavaScript on a page runs with the privileges of that origin. One altered library, tag manager, or snippet can read inputs, change what people see, and call your APIs as the user.
Security insights from Cside
Sponsored by #native_company# — Learn More
#native_title#
#native_desc#