禁止页面上的内联脚本

Question

Is there any way to prohibit the browser to execute inline scripts (code placed directly on page, not in external resource, ie event handlers, script blocks etc.) for certain page by specifying some HTTP header, policy on server or similar? I'm looking for some universal solution: cross-browser and HTTP server agnostic.

Answer 1

Basically, this is called XSS filtering and a simple answer would be to prevent it's input OR if any went through, not to render them at all . There are a lot of ways to do this, and libraries to help you as well depending on the platform.

On the entry-point, you should be filtering them. Submissions from clients should be filtered always. This is called XSS filtering.

On the rendering side, you should do something like html_entities if you want to escape special characters, especially from user input, into the page.

All of these are done on the server.

Answer 2

After a lot of googling and some discussions with colleges I have finally found the solution - Content Security Policy (good article describing the concept - "An introduction to Content Security Policy" was written by Mike West). Right now it is on Candidate Recomendation stage in W3C but the most popular browsers already supports it (unfortunately support in IE version < 10).

It does exactly what I was looking for:

• it's an response HTTP header so it's sever agnostic
• it's (more or less...) cross-browser
• it can prohibit the browser from executing inline scripts (with directive unsafe-inline ) or eval ( unsafe-eval ; eval is evil) and introduces many useful restrictions (from browser security point of view)