Cross Site Scripting (XSS, 크로스 사이트 스크립팅)

자바스크립트를 이용하여 다른 사용자의 쿠키 정보를 빼와서 해킹에 사용된다는 의미이다.

 

예방법

1. xssProtect-0.1.jar 이용

http://code.google.com/p/xssprotect/

Google Code Archive - Long-term storage for Google Code Project Hosting.

public String protectAgainstXSS(String html) {
     StringReader reader = new StringReader(html);
     StringWriter writer = new StringWriter();

	 try {
		// Parse incoming string from the "html" variable
		HTMLParser.process(reader, writer, new XSSFilter(), true);

		// Return the parsed and cleaned up string
		return writer.toString();
	} catch (HandlingException e) {
		// Handle the error here in accordance with your coding policies...
	}
}

 

2. HTMLInputFilter.java 이용

http://josephoconnell.com/java/xss-html-filter/

XSS HTML Filter: A Java library for protecting against cross site scripting

String input = ... String clean = new HTMLInputFilter().filter(input);

 

끝.