如何在使用window.location.toString（）時防止XSS攻擊

Question

我在checkmarx中收到代碼爲windw.location.toString()的錯誤什麼是最好的防止此錯誤？

錯誤：

method at line 74 gets user input for the toString() element. the elements value then flows thrugh client side code without being properly sanitized or validated and is eventually displayed to the user in line 80. this may enable t dom css attack.

Answer 1

做這樣的：

encodeURIComponent(myUrl); 

然後可以分析它安全，做做的時候：

decodeURIComponent(myUrl);