312-50V9 · Question #381
Which of the following is the BEST approach to prevent Cross-site Scripting (XSS) flaws?
The correct answer is D. Validate and escape all information sent to a server. Preventing XSS requires validating and escaping all untrusted input before rendering it, which stops injected scripts from executing in the browser.
Question
Which of the following is the BEST approach to prevent Cross-site Scripting (XSS) flaws?
Options
- AUse digital certificates to authenticate a server prior to sending data.
- BVerify access right before allowing access to protected information and UI controls.
- CVerify access right before allowing access to protected information and UI controls.
- DValidate and escape all information sent to a server.
How the community answered
(34 responses)- B6% (2)
- C3% (1)
- D91% (31)
Why each option
Preventing XSS requires validating and escaping all untrusted input before rendering it, which stops injected scripts from executing in the browser.
Digital certificates and server authentication (TLS/SSL) protect data in transit from eavesdropping but do not prevent malicious scripts from being injected into web page output.
Verifying access rights before serving protected resources is an authorization control that prevents unauthorized access, not a mitigation for script injection vulnerabilities.
This choice is identical to B and addresses access control, not the input and output handling required to prevent XSS.
XSS attacks occur when user-supplied input is rendered in a browser without sanitization, allowing attackers to inject malicious scripts. Validating input to reject unexpected characters and escaping output so that HTML special characters are rendered as data rather than executable code is the primary defense recommended by OWASP against all XSS variants.
Concept tested: Cross-site scripting XSS prevention via input validation and escaping
Source: https://owasp.org/www-community/attacks/xss/
Topics
Community Discussion
No community discussion yet for this question.