SecurityInnovation/TMContentReview — Issue #76: Escape All Untrusted Data in HTML Contexts in JSF
Author: SergeTruth
Created: 2011-11-07 22:35:33+00:00
State: open

You need to define what the HTML context is and how it differs from other contexts.

This seems repeated. The advice advocating HTML encoding could lead developers to blindly use HTML enocding any where on the page.

Use third-party libraries to escape displayed user input if needed.

Not all libraries are create equally. There are some library which work on a black list, others will only encode a subset of exploitable characters.
Still others will use different encoding schemes.

For example, some libraries JavaScript encode single or double quotes by placing a backslash in front of the character. Other libraries turn the single or double quote into its \uxxxx value. Other libraries do not encode "\" leading to other possible ways to by pass encoding.

"Use third-party libraries to escape displayed user input if needed. It may be the case that more sophisticated functionality may be required, for example for XML or JavaScript contexts. In such cases, it is recommended to use third party libraries, such as jTidy HTMLEncode, OWASP Reform, or OWASP ESAPI. Links to these libraries are available at the bottom of this page."
If you are in a JavaScript context you will not want to use jTidy HTMLEncode.