Skip to main content
Information Security

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

5
  • 4
    What are you doing to prevent XSS? Commented May 26, 2012 at 4:14
  • @MikeSamuel, I think I should be ok. Django escapes dangerous characters and I use a WYSIWYG editor for the only field they can write HTML. They can share links, but only within the same tenant. Commented May 26, 2012 at 8:05
  • @MikeSamuel, thanks for the tip! I was in fact storing HTML at the database and was in fact not protected! Now I run a html whitelist scrubber when saving this field at the database. Commented May 26, 2012 at 10:18
  • 1
    sharing links can be dangerous. javascript: URLs allow XSS and aren't stopped by Django's auto-escaping. Commented May 26, 2012 at 12:35
  • django's URLField doesn't accept URLS starting with javascript, but thanks for the tip! Commented May 26, 2012 at 12:41