6

I just tried this with Hiccup:

(hiccup.core/html [:h1 "<script>alert('xss');</script>"])

and to my surprise I got an alert box, Hiccup is not escaping strings by default. I see that there's a method to escape strings, but in my opinion if it's not the default, sooner or later you'll forget and be vulnerable to XSS.

Is there a way in Hiccup to have it escape strings by default?

Pablo Fernandez
  • 279,434
  • 135
  • 377
  • 622

2 Answers2

4

hiccup 2.0.0-alpha1 has escaping by default. You just need to change the hiccup.core/html call to hiccup2.core/html and it should work without any change.

(str (hiccup2.core/html [:h1 "<script>alert('xss');</script>"]))

I've upgraded my project from 1.0.5 and it's working without any regression.

Thiago Lewin
  • 2,810
  • 14
  • 18
2

No, but core/h is an alias for escape-html that makes it slightly more convenient:

(hiccup.core/html [:h1 (hiccup.core/h "<script>alert('xss');</script>")])
John Wiseman
  • 3,081
  • 1
  • 22
  • 31