8

While reading about the Closure Templates I encountered the following statement:

Closure Templates are contextually autoescaped to reduce the risk of XSS.

As far as I know escaping is removing ambiguity in the input string as described here.

I am not sure what really that means, perhaps an explanation with real world example would be really helpful.

trieulieuf9
  • 55
  • 1
  • 8
vivek
  • 2,807
  • 5
  • 31
  • 44

1 Answers1

8

There's more detail on security and autoescaping at this page of the Closure Templates documentation. In particular, look at the example given here.

You will see that an input, {$x} is escaped differently depending on where it is to be inserted in the template output (e.g. in HTML, JavaScript, CSS etc.) This is what is meant by contextual (i.e. context-dependent) autoescaping.

As described in the documentation:

  • When {$x} appeared inside HTML text, we entity-encoded it (< → &lt;).
  • When {$x} appeared inside a URL or as a CSS quantity, we rejected it because it had a protocol javascript: that was not http or https, and instead output a safe value #zSoyz. Had {$x} appeared in the query portion of a URL, we would have percent-encoded it instead of rejecting it outright (< → %3C).
  • When {$x} appeared in JavaScript, we wrapped it in quotes (if not already inside quotes) and escaped HTML special characters (< → \x3c).
  • When {$x} appeared inside CSS quotes, we did something similar to JavaScript, but using CSS escaping conventions (< → \3c ).

The malicious output was defanged.

Zejji Zejji
  • 497
  • 3
  • 14