So, I've been using this guide as the gold standard :
http://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%2...
what it seems to boil down to is : sanitize user input.
In what circumstances is this not sufficient?
what it seems to boil down to is : sanitize user input.
In what circumstances is this not sufficient?
But yes. Sanitizing user input (assuming a perfect sanitizer) can assure perfect XSS protection, but at a rather severe loss of features (no images / URLs / formatting in your comments). A separate, limited DSL is often the solution for this (BBCode, Markdown, etc), but those sometimes make mistakes too, especially when they're younger.
[1]: http://www.reddit.com/r/programming/comments/cluc5/html_inje...
Instead, parse the HTML just as you'd have to with BBCode or Markdown. Store it in an internal representation that's only capable of the minimum needed formatting features. (There's no actual HTML left at this stage. It's equivalent to any other DSL.) Then render HTML out of that parse tree, so that every bit of user input is HTML entity-encoded, and everything else (tags and attributes) comes from constants in the program.
This can be even more secure than regexp-based DSL translators that build up a result from input in multiple passes, since they tend to lack such a well-defined separation between input text and output HTML.
Do you know of good libraries for this type of work off the top of your head? bonus points for native java