Which is the best way to protect from XSS-attacks via jsonify() in python Flask?
This is the Python (Flask) file:
testvar = {0: {'Name': 'df',
'test1': 'sdf',
'test2': 'sdf'},
1: {'Name': 'dfdf',
'test1': 'sdf',
'test2': 'dfdf'},
2: {'Name': 'dfdf',
'test1': 'dfdfd',
'test2': 'dfdfd<script>alert("test");</script>'}}
@app.route("/test")
def test():
return jsonify(testvar)
This is the Javascript:
output_body = ""
$.getJSON('/test',function(data){
$.each(data, function(key,val){
output_body += "<tr>"
for(property in val) {
output_body += "<td>" + val[property] + "</td>"
}
output_body += "</tr>"
});
$('table').html(output_body);
});
This code execute a js alert box.
Of course I can clean the data in js by escaping the < and >. But is there a good way to protect against a XSS attack in above example?
from Best way to XSS protect jsonify output
No comments:
Post a Comment