HTML / Javascript: Should I encode, escape, or sanitize user-generated strings for alt attributes ( tags)?
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty{ height:90px;width:728px;box-sizing:border-box;
}
There seems to be many accepted answers regarding if one needs to encode user-generated HTML attributes (the alt attribute of an image for instance), 'escape' them, or 'sanitize' them.
I am wondering: If I am rendering user-generated alt attributes for img elements, how should I encode them (if at all), should I both encode and sanitize? Should I both sanitize and escape?
If I know any character has the possibility of showing up how should I process this user-generated string before setting it as an alt attribute?
javascript html security user-generated-content
asked Nov 26 '18 at 18:24
connected_userconnected_user
1261115
add a comment |
There seems to be many accepted answers regarding if one needs to encode user-generated HTML attributes (the alt attribute of an image for instance), 'escape' them, or 'sanitize' them.
I am wondering: If I am rendering user-generated alt attributes for img elements, how should I encode them (if at all), should I both encode and sanitize? Should I both sanitize and escape?
If I know any character has the possibility of showing up how should I process this user-generated string before setting it as an alt attribute?
javascript html security user-generated-content
asked Nov 26 '18 at 18:24
connected_userconnected_user
1261115
"the alt attribute of an image for instance" — For instance? Beware. The answer will vary depending on the attribute.
– Quentin
Nov 26 '18 at 18:33
Santiziation has little to do with security. How you ecape depends on the (unspecified) mechanism you are using to generate them from the input.
– Quentin
Nov 26 '18 at 18:34
Regardless of mechanism, all I know is any character is possible to appear in these alt attributes.
– connected_user
Nov 26 '18 at 18:36
While you might have any character provided as input, how you escape is still dependant on the mechanism you are using to generate the attribute from that input.
– Quentin
Nov 26 '18 at 18:37
I am using React.js to generate the markup in which this user-generated string is being used as an alt attribute of animgtag.
– connected_user
Nov 26 '18 at 18:42
add a comment |
There seems to be many accepted answers regarding if one needs to encode user-generated HTML attributes (the alt attribute of an image for instance), 'escape' them, or 'sanitize' them.
I am wondering: If I am rendering user-generated alt attributes for img elements, how should I encode them (if at all), should I both encode and sanitize? Should I both sanitize and escape?
If I know any character has the possibility of showing up how should I process this user-generated string before setting it as an alt attribute?
javascript html security user-generated-content
asked Nov 26 '18 at 18:24
connected_userconnected_user
1261115
There seems to be many accepted answers regarding if one needs to encode user-generated HTML attributes (the alt attribute of an image for instance), 'escape' them, or 'sanitize' them.
I am wondering: If I am rendering user-generated alt attributes for img elements, how should I encode them (if at all), should I both encode and sanitize? Should I both sanitize and escape?
If I know any character has the possibility of showing up how should I process this user-generated string before setting it as an alt attribute?
javascript html security user-generated-content
javascript html security user-generated-content
asked Nov 26 '18 at 18:24
connected_userconnected_user
1261115
asked Nov 26 '18 at 18:24
connected_userconnected_user
1261115
edited Nov 26 '18 at 18:30
connected_user
asked Nov 26 '18 at 18:24
connected_userconnected_user
1261115
asked Nov 26 '18 at 18:24
connected_userconnected_user
1261115
asked Nov 26 '18 at 18:24
connected_userconnected_user
1261115
1261115
"the alt attribute of an image for instance" — For instance? Beware. The answer will vary depending on the attribute.
– Quentin
Nov 26 '18 at 18:33
Santiziation has little to do with security. How you ecape depends on the (unspecified) mechanism you are using to generate them from the input.
– Quentin
Nov 26 '18 at 18:34
Regardless of mechanism, all I know is any character is possible to appear in these alt attributes.
– connected_user
Nov 26 '18 at 18:36
While you might have any character provided as input, how you escape is still dependant on the mechanism you are using to generate the attribute from that input.
– Quentin
Nov 26 '18 at 18:37
I am using React.js to generate the markup in which this user-generated string is being used as an alt attribute of animgtag.
– connected_user
Nov 26 '18 at 18:42
add a comment |
"the alt attribute of an image for instance" — For instance? Beware. The answer will vary depending on the attribute.
– Quentin
Nov 26 '18 at 18:33
Santiziation has little to do with security. How you ecape depends on the (unspecified) mechanism you are using to generate them from the input.
– Quentin
Nov 26 '18 at 18:34
Regardless of mechanism, all I know is any character is possible to appear in these alt attributes.
– connected_user
Nov 26 '18 at 18:36
While you might have any character provided as input, how you escape is still dependant on the mechanism you are using to generate the attribute from that input.
– Quentin
Nov 26 '18 at 18:37
I am using React.js to generate the markup in which this user-generated string is being used as an alt attribute of animgtag.
– connected_user
Nov 26 '18 at 18:42
"the alt attribute of an image for instance" — For instance? Beware. The answer will vary depending on the attribute.
– Quentin
Nov 26 '18 at 18:33
"the alt attribute of an image for instance" — For instance? Beware. The answer will vary depending on the attribute.
– Quentin
Nov 26 '18 at 18:33
Santiziation has little to do with security. How you ecape depends on the (unspecified) mechanism you are using to generate them from the input.
– Quentin
Nov 26 '18 at 18:34
Santiziation has little to do with security. How you ecape depends on the (unspecified) mechanism you are using to generate them from the input.
– Quentin
Nov 26 '18 at 18:34
Regardless of mechanism, all I know is any character is possible to appear in these alt attributes.
– connected_user
Nov 26 '18 at 18:36
Regardless of mechanism, all I know is any character is possible to appear in these alt attributes.
– connected_user
Nov 26 '18 at 18:36
While you might have any character provided as input, how you escape is still dependant on the mechanism you are using to generate the attribute from that input.
– Quentin
Nov 26 '18 at 18:37
While you might have any character provided as input, how you escape is still dependant on the mechanism you are using to generate the attribute from that input.
– Quentin
Nov 26 '18 at 18:37
I am using React.js to generate the markup in which this user-generated string is being used as an alt attribute of an
img tag.– connected_user
Nov 26 '18 at 18:42
I am using React.js to generate the markup in which this user-generated string is being used as an alt attribute of an
img tag.– connected_user
Nov 26 '18 at 18:42
add a comment |
2 Answers
2
active
oldest
votes
I am using React.js to generate the markup in which this user-generated string is being used as an alt attribute of an img tag
Assuming you mean that you have something along the lines of:
<img alt={this.props.alt} />
… then no, you don't need to do anything. React works on the DOM. You aren't generating HTML source code, so special characters in the data can't be used to inject JavaScript through an XSS vulnerability.
answered Nov 26 '18 at 18:45
QuentinQuentin
658k738951057
So even if the prop in questionthis.props.altcontains markup, or a script tag, or special character, I still don't need to encode or process this string in any way?
– connected_user
Nov 26 '18 at 19:25
@connected_user — That's what I said.
– Quentin
Nov 26 '18 at 20:55
add a comment |
Sanitizing is required so there are no issues with displaying the string. If you are storing the alt attribute in a database then yyou should definitely escape the string.
answered Nov 26 '18 at 18:38
IbzDawgIbzDawg
697
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53486965%2fhtml-javascript-should-i-encode-escape-or-sanitize-user-generated-strings-f%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
2 Answers
2
active
oldest
votes
2 Answers
2
active
oldest
votes
active
oldest
votes
active
oldest
votes
I am using React.js to generate the markup in which this user-generated string is being used as an alt attribute of an img tag
Assuming you mean that you have something along the lines of:
<img alt={this.props.alt} />
… then no, you don't need to do anything. React works on the DOM. You aren't generating HTML source code, so special characters in the data can't be used to inject JavaScript through an XSS vulnerability.
answered Nov 26 '18 at 18:45
QuentinQuentin
658k738951057
So even if the prop in questionthis.props.altcontains markup, or a script tag, or special character, I still don't need to encode or process this string in any way?
– connected_user
Nov 26 '18 at 19:25
@connected_user — That's what I said.
– Quentin
Nov 26 '18 at 20:55
add a comment |
I am using React.js to generate the markup in which this user-generated string is being used as an alt attribute of an img tag
Assuming you mean that you have something along the lines of:
<img alt={this.props.alt} />
… then no, you don't need to do anything. React works on the DOM. You aren't generating HTML source code, so special characters in the data can't be used to inject JavaScript through an XSS vulnerability.
answered Nov 26 '18 at 18:45
QuentinQuentin
658k738951057
So even if the prop in questionthis.props.altcontains markup, or a script tag, or special character, I still don't need to encode or process this string in any way?
– connected_user
Nov 26 '18 at 19:25
@connected_user — That's what I said.
– Quentin
Nov 26 '18 at 20:55
add a comment |
I am using React.js to generate the markup in which this user-generated string is being used as an alt attribute of an img tag
Assuming you mean that you have something along the lines of:
<img alt={this.props.alt} />
… then no, you don't need to do anything. React works on the DOM. You aren't generating HTML source code, so special characters in the data can't be used to inject JavaScript through an XSS vulnerability.
answered Nov 26 '18 at 18:45
QuentinQuentin
658k738951057
I am using React.js to generate the markup in which this user-generated string is being used as an alt attribute of an img tag
Assuming you mean that you have something along the lines of:
<img alt={this.props.alt} />
… then no, you don't need to do anything. React works on the DOM. You aren't generating HTML source code, so special characters in the data can't be used to inject JavaScript through an XSS vulnerability.
answered Nov 26 '18 at 18:45
QuentinQuentin
658k738951057
answered Nov 26 '18 at 18:45
QuentinQuentin
658k738951057
answered Nov 26 '18 at 18:45
QuentinQuentin
658k738951057
answered Nov 26 '18 at 18:45
QuentinQuentin
658k738951057
658k738951057
So even if the prop in questionthis.props.altcontains markup, or a script tag, or special character, I still don't need to encode or process this string in any way?
– connected_user
Nov 26 '18 at 19:25
@connected_user — That's what I said.
– Quentin
Nov 26 '18 at 20:55
add a comment |
So even if the prop in questionthis.props.altcontains markup, or a script tag, or special character, I still don't need to encode or process this string in any way?
– connected_user
Nov 26 '18 at 19:25
@connected_user — That's what I said.
– Quentin
Nov 26 '18 at 20:55
So even if the prop in question
this.props.alt contains markup, or a script tag, or special character, I still don't need to encode or process this string in any way?– connected_user
Nov 26 '18 at 19:25
So even if the prop in question
this.props.alt contains markup, or a script tag, or special character, I still don't need to encode or process this string in any way?– connected_user
Nov 26 '18 at 19:25
@connected_user — That's what I said.
– Quentin
Nov 26 '18 at 20:55
@connected_user — That's what I said.
– Quentin
Nov 26 '18 at 20:55
add a comment |
Sanitizing is required so there are no issues with displaying the string. If you are storing the alt attribute in a database then yyou should definitely escape the string.
answered Nov 26 '18 at 18:38
IbzDawgIbzDawg
697
add a comment |
Sanitizing is required so there are no issues with displaying the string. If you are storing the alt attribute in a database then yyou should definitely escape the string.
answered Nov 26 '18 at 18:38
IbzDawgIbzDawg
697
add a comment |
Sanitizing is required so there are no issues with displaying the string. If you are storing the alt attribute in a database then yyou should definitely escape the string.
answered Nov 26 '18 at 18:38
IbzDawgIbzDawg
697
Sanitizing is required so there are no issues with displaying the string. If you are storing the alt attribute in a database then yyou should definitely escape the string.
answered Nov 26 '18 at 18:38
IbzDawgIbzDawg
697
answered Nov 26 '18 at 18:38
IbzDawgIbzDawg
697
answered Nov 26 '18 at 18:38
IbzDawgIbzDawg
697
answered Nov 26 '18 at 18:38
IbzDawgIbzDawg
697
697
add a comment |
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53486965%2fhtml-javascript-should-i-encode-escape-or-sanitize-user-generated-strings-f%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
"the alt attribute of an image for instance" — For instance? Beware. The answer will vary depending on the attribute.
– Quentin
Nov 26 '18 at 18:33
Santiziation has little to do with security. How you ecape depends on the (unspecified) mechanism you are using to generate them from the input.
– Quentin
Nov 26 '18 at 18:34
Regardless of mechanism, all I know is any character is possible to appear in these alt attributes.
– connected_user
Nov 26 '18 at 18:36
While you might have any character provided as input, how you escape is still dependant on the mechanism you are using to generate the attribute from that input.
– Quentin
Nov 26 '18 at 18:37
I am using React.js to generate the markup in which this user-generated string is being used as an alt attribute of an
imgtag.– connected_user
Nov 26 '18 at 18:42