xss-filters

Context-aware output encoders for preventing cross-site scripting. Each filter applies the minimal encoding required so an untrusted string cannot break out of a declared HTML output context and run script.

Supported contexts: HTML data, HTML comment, single/double/unquoted attribute values, and URIs placed inside any of those. URI filters also normalize IPv6 hosts and block dangerous protocols such as javascript: and data:.

Installation

[dependencies]
xss-filters = "0.1"

Usage

Match the filter to the exact place the value lands in the document.

use xss_filters::{in_html_data, in_double_quoted_attr, uri_in_double_quoted_attr};

// <div>{{ value }}</div>
assert_eq!(in_html_data("<script>"), "&lt;script>");

// <input value="{{ value }}">
assert_eq!(in_double_quoted_attr("a\"b"), "a&quot;b");

// <a href="{{ value }}">
assert_eq!(uri_in_double_quoted_attr("javascript:alert(1)"), "x-javascript:alert(1)");

Do not apply these filters inside scriptable contexts such as <script>, <style>, on* attributes, or style attributes. They target HTML and URI contexts only.

Features

std (default): enable std::error::Error impls. The crate is otherwise no_std plus alloc.
css: expose the css module. It escapes CSS strings, validates CSS values, neutralizes expression(...) and url(...) tricks, and blocks dangerous URL protocols. Enable it for style attributes and <style> blocks.

[dependencies]
xss-filters = { version = "0.1", features = ["css"] }

No-std

The crate builds without std and depends only on alloc. Disable default features to drop the std error impls.

[dependencies]
xss-filters = { version = "0.1", default-features = false }

License