javascript - 反射型 XSS 保护 - 澄清吗？

Question

阅读后this article作者:Eric Lawrence，我看到了这个测试页 http://www.enhanceie.com/test/xss/它模拟了Reflective XSS Protection的使用。

现在，根据google chromium :

XSS filter checks whether a script that's about to run on a web page is also present in the request that fetched that web page. If the script is present in the request, that's a strong indication that the web server might have been tricked into reflecting the script.

所以，如果我发布到服务器:

<script>alert("bang! script injection\n"+document.cookie);</script>

浏览器也可以在通过网址请求时看到它:

http://webdbg.com/test/xss/Hello.asp?txtName=%3Cscript%3Ealert%28%22bang%21+script+injection%5Cn%22%2Bdocument.cookie%29%3B%3C%2Fscript%3E

然后它显示此错误(控制台):

The XSS Auditor refused to execute a script in 'http://webdbg.com/test/xss/Hello.asp?txtName=%3Cscript%3Ealert%28%22bang%21+script+injection%5Cn%22%2Bdocument.cookie%29%3B%3C%2Fscript%3E' because its source code was found within the request. The auditor was enabled as the server sent neither an 'X-XSS-Protection' nor 'Content-Security-Policy' header.

但是 fiddler 确实向我显示该页面确实让脚本运行:

问题:

由于处理xss的解决方案是html Encode/decode ，

如何/何时我应该结合这两种解决方案？

我的意思是我可以使用 html 编码，而脚本永远不会在我的页面中运行，或者，我可以使用这个 header ...？

我很困惑。

Answer 1

But fiddler does show me that the page did get the script to run

不，事实并非如此。 Fiddler 向您显示服务器将脚本发送回浏览器。它绝对不会告诉您浏览器对脚本执行的操作。

As the solution to deal with xss is html Encode/decode

这是一种解决方案(如果您不需要允许用户提交任何类型的 HTML，这也是最简单和最好的解决方案)。

How/when should I combine between those 2 solutions?

您应该通过编码实体将获得的任何用户输入编码为 HTML，并忽略某些浏览器中出现的反 XSS 过滤器，因为并非所有浏览器都有它们，因此您不能依赖它们。

I mean I could use html encode and scripts would never run in my page

仅对用户输入进行编码(因为它不受信任)。不要对您自己编写的可以信任的脚本进行编码。