Best practice for embedding arbitrary JSON in the DOM?

Question

I\'m thinking about embedding arbitrary JSON in the DOM like this:

Answer 1

See Rule #3.1 in OWASP's XSS prevention cheat sheet.

Say you want to include this JSON in HTML:

{
    "html": ""
}

Create a hidden

in HTML. Next, escape your JSON by encoding unsafe entities (e.g., &, <, >, ", ', and, /) and put it inside the element.

        {"html":"<script>alert(\"XSS!\");</script>"}

Now you can access it by reading the textContent of the element using JavaScript and parsing it:

var text = document.querySelector('#init_data').textContent;
var json = JSON.parse(text);
console.log(json); // {html: ""}

0 讨论(0)

查看其它7个回答

发布评论:

提交评论

---

•  加载中...