将加密的数据发送到服务器时，Javascript中的XSS

Question

What is the best way of input sanitisation in Javascript when dealing with encrypted data? Lets say Bob enters the malicius code in the form instead of the regular message, my JS enrypts it with RSA and sends to server where the message waits for Alice to retrieve it. After decryption on Alice computer the malicious code steals some important secret from LocalStorage for example.

Am I right the only way is to check if the message contains some bad code right after decryption? Maybe allow only alphanumeric charachters with some other basic ones to be allowed and when decrypted message contains anything else just stop script from running and erase the msg from memory?

Answer 1

I think the best solution here is not to sanitize Bob's input, but sanitize it before displaying to Alice . Thus even if there is some malicious code entered by Bob, it will never get executed before displaying.

So, just do something like this:

1. Bob enters malicious message and encrypts it via RSA.
2. Message is sent to server
3. Alice retrieves her message, decodes it and performs message sanitizing before displaying . Even simple replacement of quotes ( " and ' ) and brackets ( < and > ) with appropriate HTML entities ( " , < etc) by JavaScript before displaying the decrypted message is enough to keep Alice safe from XSS.

Thus the code will not steal anything from Alice.