Cross-Site Scripting (XSS) Attacks: Complete Defense Guide

// Reflected XSS example
// URL: https://example.com/search?q=<script>alert('XSS')</script>
// If page displays q without encoding:
<div>Search results for: <script>alert('XSS')</script></div>

// Stored XSS example
// User input stored in database:
<script>document.cookie</script>
// Displayed to all users later

Complete XSS Prevention System:

#!/usr/bin/env python3
"""
Production-ready XSS Prevention System
Comprehensive output encoding, CSP, input validation, and monitoring
"""

import html
import re
import json
import logging
from typing import Any, Optional, Dict
from enum import Enum
from dataclasses import dataclass
from html.parser import HTMLParser

logger = logging.getLogger(__name__)


class XSSContext(Enum):
    """XSS encoding context."""
    HTML = "html"
    HTML_ATTRIBUTE = "html_attribute"
    JAVASCRIPT = "javascript"
    CSS = "css"
    URL = "url"


class XSSDetector:
    """Detect XSS attempts in input."""
    
    XSS_PATTERNS = [
        (r"<script[^>]*>.*?</script>", "Script tag injection"),
        (r"javascript:", "JavaScript protocol"),
        (r"on\w+\s*=", "Event handler injection"),
        (r"<iframe[^>]*>", "Iframe injection"),
        (r"<object[^>]*>", "Object injection"),
        (r"<embed[^>]*>", "Embed injection"),
        (r"expression\s*\(", "CSS expression"),
        (r"vbscript:", "VBScript protocol"),
    ]
    
    @staticmethod
    def detect(input_value: str) -> Optional[Dict]:
        """Detect XSS attempt in input.
        
        Args:
            input_value: Input value to check
            
        Returns:
            Detection result if found, None otherwise
        """
        if not isinstance(input_value, str):
            return None
        
        input_lower = input_value.lower()
        
        for pattern, description in XSSDetector.XSS_PATTERNS:
            if re.search(pattern, input_lower, re.IGNORECASE | re.DOTALL):
                return {
                    'pattern': pattern,
                    'description': description,
                    'input': input_value
                }
        
        return None


class XSSEncoder:
    """XSS prevention encoder for different contexts."""
    
    @staticmethod
    def encode_html(text: str) -> str:
        """Encode text for HTML context.
        
        Args:
            text: Text to encode
            
        Returns:
            HTML-encoded text
        """
        return html.escape(text, quote=False)
    
    @staticmethod
    def encode_html_attribute(text: str) -> str:
        """Encode text for HTML attribute context.
        
        Args:
            text: Text to encode
            
        Returns:
            HTML attribute-encoded text
        """
        return html.escape(text, quote=True)
    
    @staticmethod
    def encode_javascript(text: str) -> str:
        """Encode text for JavaScript context.
        
        Args:
            text: Text to encode
            
        Returns:
            JavaScript-encoded text
        """
        # Escape JavaScript special characters
        replacements = {
            '\\': '\\\\',
            '"': '\\"',
            "'": "\\'",
            '\n': '\\n',
            '\r': '\\r',
            '\t': '\\t',
            '<': '\\x3C',
            '>': '\\x3E'
        }
        
        encoded = text
        for char, replacement in replacements.items():
            encoded = encoded.replace(char, replacement)
        
        return encoded
    
    @staticmethod
    def encode_css(text: str) -> str:
        """Encode text for CSS context.
        
        Args:
            text: Text to encode
            
        Returns:
            CSS-encoded text
        """
        # CSS encoding - escape special characters
        return re.sub(r'[^a-zA-Z0-9]', lambda m: f'\\{hex(ord(m.group()))[1:]} ', text)
    
    @staticmethod
    def encode_url(text: str) -> str:
        """Encode text for URL context.
        
        Args:
            text: Text to encode
            
        Returns:
            URL-encoded text
        """
        from urllib.parse import quote
        return quote(text, safe='')
    
    @staticmethod
    def encode(text: str, context: XSSContext) -> str:
        """Encode text for specific context.
        
        Args:
            text: Text to encode
            context: Encoding context
            
        Returns:
            Encoded text
        """
        encoders = {
            XSSContext.HTML: XSSEncoder.encode_html,
            XSSContext.HTML_ATTRIBUTE: XSSEncoder.encode_html_attribute,
            XSSContext.JAVASCRIPT: XSSEncoder.encode_javascript,
            XSSContext.CSS: XSSEncoder.encode_css,
            XSSContext.URL: XSSEncoder.encode_url,
        }
        
        encoder = encoders.get(context)
        if encoder:
            return encoder(text)
        return html.escape(text)  # Default to HTML encoding


class XSSSanitizer:
    """Sanitize HTML to remove XSS vectors."""
    
    ALLOWED_TAGS = ['p', 'br', 'strong', 'em', 'u', 'a', 'ul', 'ol', 'li']
    ALLOWED_ATTRIBUTES = {
        'a': ['href', 'title'],
        'img': ['src', 'alt', 'title']
    }
    
    @staticmethod
    def sanitize_html(html_content: str) -> str:
        """Sanitize HTML content.
        
        Args:
            html_content: HTML content to sanitize
            
        Returns:
            Sanitized HTML
        """
        # Remove script tags and event handlers
        sanitized = re.sub(r'<script[^>]*>.*?</script>', '', html_content, flags=re.IGNORECASE | re.DOTALL)
        sanitized = re.sub(r'on\w+\s*=\s*["\'][^"\']*["\']', '', sanitized, flags=re.IGNORECASE)
        sanitized = re.sub(r'javascript:', '', sanitized, flags=re.IGNORECASE)
        
        # In production, use library like bleach for proper HTML sanitization
        return sanitized


# Flask integration with XSS protection
from flask import Flask, request, jsonify, Response

app = Flask(__name__)

# Set Content Security Policy header
@app.after_request
def set_csp_header(response):
    """Set Content Security Policy header."""
    csp_policy = (
        "default-src 'self'; "
        "script-src 'self' 'unsafe-inline' 'unsafe-eval'; "
        "style-src 'self' 'unsafe-inline'; "
        "img-src 'self' data: https:; "
        "font-src 'self' data:; "
        "connect-src 'self'; "
        "frame-ancestors 'none'; "
        "base-uri 'self'; "
        "form-action 'self'"
    )
    response.headers['Content-Security-Policy'] = csp_policy
    response.headers['X-Content-Type-Options'] = 'nosniff'
    response.headers['X-Frame-Options'] = 'DENY'
    response.headers['X-XSS-Protection'] = '1; mode=block'
    return response


@app.route('/api/comment', methods=['POST'])
def create_comment():
    """Create comment with XSS protection."""
    data = request.json
    comment = data.get('comment', '')
    
    # Detect XSS attempts
    xss_attempt = XSSDetector.detect(comment)
    if xss_attempt:
        logger.warning(f"XSS attempt detected: {xss_attempt['description']}")
        return jsonify({'error': 'Invalid input detected'}), 400
    
    # Encode for HTML context
    safe_comment = XSSEncoder.encode(comment, XSSContext.HTML)
    
    # Save to database (use safe_comment, not original)
    # db.save_comment(safe_comment)
    
    return jsonify({'message': 'Comment created', 'comment': safe_comment})


@app.route('/api/search')
def search():
    """Search endpoint with XSS protection."""
    query = request.args.get('q', '')
    
    # Encode for URL/HTML context
    safe_query = XSSEncoder.encode(query, XSSContext.HTML)
    
    # Use in response
    return jsonify({
        'query': safe_query,
        'results': []
    })


@app.route('/api/user/<username>')
def get_user(username):
    """Get user with XSS protection in URL."""
    # Encode username for HTML context
    safe_username = XSSEncoder.encode(username, XSSContext.HTML)
    
    return jsonify({
        'username': safe_username,
        'data': 'user_data'
    })


# JavaScript client-side XSS prevention
XSS_PREVENTION_JS = """
// Client-side XSS prevention utilities

function escapeHtml(text) {
    const map = {
        '&': '&amp;',
        '<': '&lt;',
        '>': '&gt;',
        '"': '&quot;',
        "'": '&#039;'
    };
    return text.replace(/[&<>"']/g, m => map[m]);
}

function escapeHtmlAttribute(text) {
    return escapeHtml(text).replace(/"/g, '&quot;');
}

function escapeJavaScript(text) {
    return text
        .replace(/\\\\/g, '\\\\\\\\')
        .replace(/'/g, "\\\\'")
        .replace(/"/g, '\\\\"')
        .replace(/\\n/g, '\\\\n')
        .replace(/\\r/g, '\\\\r')
        .replace(/</g, '\\\\x3C')
        .replace(/>/g, '\\\\x3E');
}

// Safe DOM manipulation
function setTextContent(element, text) {
    element.textContent = text; // Automatically escapes
}

function setInnerHTML(element, html) {
    // Only use with trusted, sanitized HTML
    element.innerHTML = html;
}

// Example usage
function displayUserComment(comment) {
    const div = document.getElementById('comment');
    // Safe - textContent automatically escapes
    div.textContent = comment;
    
    // Unsafe - would allow XSS
    // div.innerHTML = comment;
}
"""


if __name__ == '__main__':
    # Example usage
    user_input = "<script>alert('XSS')</script>"
    
    # Encode for HTML
    safe_output = XSSEncoder.encode(user_input, XSSContext.HTML)
    print(f"Safe HTML: {safe_output}")
    
    # Detect XSS
    detection = XSSDetector.detect(user_input)
    if detection:
        print(f"XSS detected: {detection['description']}")