As many of you know, I am a huge fan of the Windows Vista Sidebar Gadget. Most notably, I have blogged about the UT3 Vista Gadget that lets your keep track of your servers. What many of you don't know is that I am also a huge fan of developing gadgets. Earlier tonight I read a great post on MSDN about improving the quality of the Vista Gadgets that you develop. Truth be told, most of the material would be very useful in any web-based gadget or widget. Google Gadgets, Yahoo Widgets, web parts, and anything else you can think of. The link to the site is at the bottom of this post and it was written by Michael Howard and David Ross. From what I can tell, these guys know their stuff (and suffer from a little bit of common sense).
The bulk of the article offers some advice and code on how to secure your gadgets and avoid any cross site scripting (css) attacks. The golden rule, and this applies to any programming, is to never trust input. Malicious and/or malformed input can lead to a whole host of problems. Many applications, including gadgets, read, manipulate, and then display untrusted data. This is often from an XMLHttpRequest object or an ActiveX control. The solution is to validate your input. Validate, Validate, Validate!
One good way to validate input is to build a function that can check for invalid characters in the input such as apostrophes and quotes. The first example that they provided allows numbers, brackets, dashes and spaces between 6 and 14 characters. They also have samples for sanitizing input, enclosing untrusted data, setting the gadget code page, reviewing the gadget for bugs, and more. If you want to know more about it, check out their excellent article!
Validate Input
// returns null on failure
function isValid(str) {
var regexp = /^[\d\-\(\)\s]{6,14}$/gi;
return regexp.exec(str);
}
Read the original article...
Currently rated 5.0 by 1 people
- Currently 5/5 Stars.
- 1
- 2
- 3
- 4
- 5