有没有办法阻止JavaScript在我的网站上运行？

Question

My goal here is to stop any attempts at malicious JavaScript code insertion by users who can post content to my website. Assuming my site has no use for JavaScript, is there some tag I can put at the top of each page or some other way to accomplish no possibility of JS running on my page? (a tiny bit of JS at the beginning of the page would be OK as long as it would make sure no more could execute) Thanks a bunch.

Answer 1

Yes, there is!

Most modern web browsers support the Content-Security-Policy header, which will allow you to declare in a HTTP header where your site will load certain types of content from, including Javascript code. It is perfectly feasible to declare that your site will not load any Javascript code, nor declare any inline, and this will effectively disable Javascript on your site.

A simple policy that disables all Javascript might be:

Content-Security-Policy: script-src 'none'

Keep in mind, however, that not all browsers implement Content-Security-Policy . You will still need to perform appropriate data sanitization to protect browsers which do not support CSP.

Answer 2

The type of attack you're trying to prevent is called cross-site scripting . so that's where you'll want to start for learning how to prevent it.

The simplest thing to do is to escape special characters in user input so that users can't post HTML tags such as <script> . That'll work if users shouldn't be able to post HTML at all. If you need to allow some kinds of HTML but not scripts, then you should look into more sophisticated HTML-sanitization techniques.