Antisamy or Content Security Policy or both to prevent XSS attack

Question

Recently I studied a lot related to XSS attacks. I was searching for prevention techniques of XSS attack.

I came across a library called Antisamy, suggested by OWASP. AntiSamy is an HTML, CSS and JavaScript filter for Java that sanitizes user input based on a policy file. AntiSamy is not an HTML, CSS and JavaScript validator. It is merely a way to make sure HTML, CSS and JavaScript input strictly follows rules defined by a policy file

Also I have read about a HTTP response header called Content Security Policy (CSP). It allows you to create a whitelist of sources of trusted content, and instructs the browser to only execute or render resources from those sources.

So should I use only Antisamy or CSP or using both will be beneficial?

Thank you in advance.

If your looking for maximum security and have the time, I say implement both. Defense in depth. — Kevin Bowersox, Feb 19 '14 at 10:42

oreoshake · Accepted Answer · 2014-02-21T01:19:55.267

3

When it comes to security, the answer is always both/all/everything so long as you have the time.

They are both beneficial in their own right.

I'd argue CSP is more beneficial long term, but I'm highly biased.

EDIT based on completely valid comment

CSP is not supported by all user agents, whereas anti-sammy is user-agent agnostic.

edited Feb 21 '14 at 01:19

answered Feb 20 '14 at 01:34

oreoshake

4,712
1
31
38

2

Just remember that CSP is part of HTML5 which doesn't exist yet as an official spec. Even after it does, supposedly at the end of 2014, there will be browser versions out in the wild for years that don't support the CSP flag. – LaJmOn Feb 20 '14 at 22:31

score 1 · Answer 2 · answered Feb 21 '14 at 09:30

1

There have been exploits found to AntiSamy in the past and there will probably be in the future as XSS attacks get cleverer (check out this video on mXSS).

It would be advisable to use both. AntiSamy will be effective for browsers that do not support CSP. CSP will be effective for current and future supported browsers.

answered Feb 21 '14 at 09:30

SilverlightFox

32,436
11
76
145

1

Exploit link broken. Update please. – verstappen_doodle Dec 02 '16 at 15:42

Antisamy or Content Security Policy or both to prevent XSS attack

2 Answers2