serialize cross-site scripting (XSS) attacks any patch available

Question

Any Patch is available for below Issue i have not upgraded Security enhancements

In general, we’ve removed serialize/unserialize from most the code to improve protection against remote code execution attacks. We’ve enhanced protection of code where use of object serialization or unserialization was unavoidable. Additionally, we’ve increased our use of output escaping to protect against cross-site scripting (XSS) attacks.

So you need to inject \Magento\Framework\Serialize\Serializer\Json class for serialize and unserialize values.

use following code for serialize and unserialize values.

protected $serialize;

public function __construct(
    \Magento\Framework\Serialize\Serializer\Json $serialize
) {
    $this->serialize = $serialize;
}

public function serialize($value){
    return $this->serialize->serialize($value);
}

public function unserialize($value){
    return $this->serialize->unserialize($value);
}

Answer 1

You can also get this from .htaccess file?

# Extra Security Headers
<IfModule mod_headers.c>
    Header set X-XSS-Protection "1; mode=block"
    Header always append X-Frame-Options SAMEORIGIN
    Header set X-Content-Type-Options nosniff
</IfModule>

Google it for an explanation.