java - 标记用户提供的内容的编码约定(提高对 XSS 漏洞的认识)

Question

您是否知道任何好的编码约定可以快速警告程序员某些变量(或配置条目等)包含用户提供的内容？我试图提高人们对几种攻击媒介(例如 XSS)的认识，这些攻击媒介是将未转义的内容粘贴到 HTML/JavaScript/HTTP 中的结果。

例如:

String UserName_UNTRUSTED = readUrlParam("username");

添加以澄清:我专门寻找 Java 编码约定。

Answer 1

一个不错的选择是:

All strings that come from the user must be stored in variables (or database columns) with a name starting with the prefix "us" (for Unsafe String). All strings that have been HTML encoded or which came from a known-safe location must be stored in variables with a name starting with the prefix "s" (for Safe string).

这摘自 Joel 的一篇有关命名约定的帖子，您可以阅读全文: http://www.joelonsoftware.com/articles/Wrong.html