Panggi Libersa Jasri Akadol panggi

☕

Brewing something

ML models: hf.co/panggi

panggi / esapi

Created February 7, 2011 20:47

String safe = ESAPI.encoder().encodeForHTML( request.getParameter( "input" ) );

panggi / xss-rule-2.html

Created February 7, 2011 20:48

	<div attr=...ESCAPE UNTRUSTED DATA BEFORE PUTTING HERE...>content</div> inside UNquoted attribute

	<div attr='...ESCAPE UNTRUSTED DATA BEFORE PUTTING HERE...'>content</div> inside single quoted attribute

	<div attr="...ESCAPE UNTRUSTED DATA BEFORE PUTTING HERE...">content</div> inside double quoted attribute

panggi / esapi2

Created February 7, 2011 20:50

String safe = ESAPI.encoder().encodeForHTMLAttribute( request.getParameter( "input" ) );

panggi / xss-rule-3.html

Created February 7, 2011 20:51

	<script>alert('...ESCAPE UNTRUSTED DATA BEFORE PUTTING HERE...')</script> inside a quoted string

	<script>x='...ESCAPE UNTRUSTED DATA BEFORE PUTTING HERE...'</script> one side of a quoted expression

	<div onmouseover="x='...ESCAPE UNTRUSTED DATA BEFORE PUTTING HERE...'"</div> inside quoted event handler

panggi / xss-rule-3.1.html

Created February 7, 2011 20:53

	<script>
	window.setInterval('...EVEN IF YOU ESCAPE UNTRUSTED DATA YOU ARE XSSED HERE...');
	</script>

panggi / esapi3

Created February 7, 2011 20:56

 String safe = ESAPI.encoder().encodeForJavaScript( request.getParameter( "input" ) );

panggi / xss-rule-4.html

Created February 7, 2011 20:57

	<style>selector { property : ...ESCAPE UNTRUSTED DATA BEFORE PUTTING HERE...; } </style> property value

	<style>selector { property : "...ESCAPE UNTRUSTED DATA BEFORE PUTTING HERE..."; } </style> property value

	<span style="property : ...ESCAPE UNTRUSTED DATA BEFORE PUTTING HERE...">text</style> property value

panggi / esapi4

Created February 7, 2011 20:59

String safe = ESAPI.encoder().encodeForCSS( request.getParameter( "input" ) );

panggi / xss-rule-5.html

Created February 7, 2011 21:00

 <a href="http://www.somesite.com?test=...ESCAPE UNTRUSTED DATA BEFORE PUTTING HERE...">link</a >  

panggi / esapi5

Created February 7, 2011 21:01

String safe = ESAPI.encoder().encodeForURL( request.getParameter( "input" ) );