Databases
StackOverflow2013
Postsdbo
PO
 

Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <blockquote> <p>I am not using any JavaScript in any of the view pages. Even if I use do I really need to implement code to bypass XSS Attack.</p> </blockquote> <p>You can be vulnerable to XSS even if you don't use JavaScript in your pages. XSS occurs when you incorporate content controlled by an attacker without properly encoding it.</p> <p>Anytime you do something like</p> <pre><code>response.write("&lt;b&gt;" + x + "&lt;/b&gt;") </code></pre> <p>where an attacker can cause <code>x</code> to contain HTML that contains JavaScript, then you are vulnerable to XSS.</p> <p>The solution is usually not to write large amounts of code. Typically the solution is to encode <code>$x</code> and any other values controlled by an attacker before including them in the HTML you generate.</p> <pre><code>response.write("&lt;b&gt;" + escapePlainTextToHtml(x) + "&lt;/b&gt;") </code></pre> <p>Filtering or sanitizing inputs can help provide an additional layer of protection.</p> <p><code>&lt;shameless-plug&gt;</code></p> <p>You can also use a template language that encodes output automatically to protect against XSS.</p> <p><a href="http://code.google.com/closure/templates/docs/security.html" rel="noreferrer">Closure Template</a> is one such option for Java.</p> <blockquote> <p>Contextual autoescaping works by augmenting Closure Templates to properly encode each dynamic value based on the context in which it appears, thus defending against XSS vulnerabilities in values that are controlled by an attacker.</p> </blockquote> <p>EDIT</p> <p>Since you are using JSF you should read up on <a href="http://java.dzone.com/articles/securing-your-jsf-pages" rel="noreferrer">XSS mitigation in JSF</a>:</p> <blockquote> <p><strong>Escape output text</strong></p> <p><code>&lt;h:outputText/&gt;</code> and <code>&lt;h:outputLabel/&gt;</code> by default has the escape attribute set to True. By using this tag to display outputs, you are able to mitigate majority of the XSS vulnerability.</p> <p><strong>SeamTextParser and <code>&lt;s:formattedText/&gt;</code></strong></p> <p>If you would like to allow users to utilise some of the basic html tags to customise their inputs, JBoss Seam provides a <code>&lt;s:formattedText/&gt;</code> tag that allows some basic html tags and styles specified by users.</p> </blockquote>
    singulars
    1. This table or related slice is empty.
    1. POCSRF, XSS and SQL Injection attack prevention in JSF
      singulars
      1. PTQuestion
    1. PTAnswer
    1. USMike Samuel
    1. USMike Samuel
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. VO
      singulars
      1. PO
      1. This table or related slice is empty.
      1. VTUpMod
    2. VO
      singulars
      1. PO
      1. This table or related slice is empty.
      1. VTUpMod
    1. COSorry I am not very clear with your answer.
      singulars
      1. PO
      1. USAngelsandDemons
    2. CO@ankit, Is there a particular sentence that you find confusing?
      singulars
      1. PO
      1. USMike Samuel
    3. COProblem is I am using JSF and i guess just like other frameworks it automatically generates HTML..So I am still clueless about what your wrote..I also went through the closure template..It is so new to me...
      singulars
      1. PO
      1. USAngelsandDemons
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload