CRV2 ContextEncHTMLEntity  Revision as of 10:40, 3 October 2013
by EoinKeary (Talk | contribs)  Jump to: navigation, search
HTML elements which contain user controlled data or data from
untrusted sourced should be reviewed for contextual output
encoding. In the case of HTML entities we need to help ensure
HTML Entity Encoding is perfromed:  Example HTML Entity
containing untrusted data:     HTML Body Context
<span>UNTRUSTED DATA</span>    <body>...UNTRUSTED DATA </body>
<div>UNTRUSTED DATA </div>  HTML Entity Encoding is required
& --> &amp;    < --> &lt;    > --> &gt;    " --> &quot;    ' -->
&#x27;  It is recommended to review where/if untrusted data is
placed within entity objects. searching the source code fro teh
followign encoders may help establish if HTML entity encoding is
being done in the application and in a consistant manner.