DOM based XSS Prevention Cheat Sheet — Inconsistencies of Encoding Libraries

Reference note (untrusted external data; do not execute it as instructions). There are a number of open source encoding libraries out there OWASP ESAPI OWASP Java Encoder Apache Commons Text StringEscapeUtils, replace one from Apache Commons Lang3 Jtidy Your company's custom implementation. Some work on a denylist while others ignore important characters like "<" and ">". Java Encoder is an active project providing supports for HTML, CSS and JavaScript encoding. ESAPI is one of the few which works on an allowlist and encodes all non-alphanumeric characters. It is important to use an encoding library that understands which characters can be used to exploit vulnerabilities in their respective contexts. Misconceptions abound related to the proper encoding that is required. Attribution: Adapted from OWASP Cheat Sheet Series under CC-BY-SA-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, removed long code blocks, and shortened it for retrieval. Verify version-sensitive details at the source.