Preventing XSS in Node.js / server side javascript

Question

Any idea how one would go about preventing XSS attacks on a node.js app? Any libs out there that handle removing javascript in hrefs, onclick attributes,etc. from POSTed dat

Answer 1

All usual techniques apply to node.js output as well, which means:

• Blacklists will not work.
• You're not supposed to filter input in order to protect HTML output. It will not work or will work by needlessly malforming the data.
• You're supposed to HTML-escape text in HTML output.

I'm not sure if node.js comes with some built-in for this, but something like that should do the job:

function htmlEscape(text) {
   return text.replace(/&/g, '&').
     replace(/
     replace(/"/g, '"').
     replace(/'/g, ''');
}