Cover Image
QR Code

Securing the Tangled Web.

The article provides an overview of how cross-site scripting (XSS) vulnerabilities emerge and why it is so difficult to avoid the problem in real-world Web application software development. Topics discussed include the traditional advice to prevent XSS, the existing approaches to the prevention and...

Full description

Published in:Communications of the ACM Vol. 57; no. 9; pp. 38 - 48
Main Author: KERN, CHRISTOPH
Format: Article
Published: Association for Computing Machinery Sep2014
Subjects:
Computer software development
Web-based user interfaces
Web design
Computer viruses
Computer networks
Google Inc.
Online Access:View this record in EBSCOhost
Summary:The article provides an overview of how cross-site scripting (XSS) vulnerabilities emerge and why it is so difficult to avoid the problem in real-world Web application software development. Topics discussed include the traditional advice to prevent XSS, the existing approaches to the prevention and detection of XSS, and the concept of strictly contextually auto-escaping template engines. Also discussed is an approach developed by Internet company Google to limit code that could potentially give rise to XSS vulnerabilities.