How to prevent cross side scripting in graphql input fields magento2

Question

Here is an example, how to prevent cross side scripting for the firstname & lastname input fields. If any one have the solution please advise.

mutation{           
        createCompanyUser ( 
            input: {   email: "demousercustom@mailinator.com"
                        firstname: " id=X tabindex=1 onfoucs=alert(document.domain)></script>"
                        lastname: "demo'??>'><<"
                        job_title: "Developer"
                        role_id : "MTY2"
                        role_name: "Basic User"
                        status : ACTIVE
                        telephone : "3324545676"
                        country_code: "+1"
                        company_ids : "133"
                    } 
                    ) {
                        user {
                          created_at
                          email
                          }
                    }}

Answer 1

How to secure your magento2 store against XSS

1. Sanitize data input: Ensure that all the data is filtered and validated at both ends (server and client) before reflecting back to the user. Such as values of search parameters, user details.

Filter out, convert special characters like < , >, /, ?, & to their HTML or URL encoded values.

2. Implement Security Headers: Consider implementing x-xss-protection header it will block pages from loading when they detect potential xss attack.

X-XSS-Protection: 1; mode=block

or consider using Strict-Transport-Security header it will only allow execution of scripts from known, valid resources that are trusted by application.

You can override this mutation file and add validation to the input param where cross-side scripting is possible. You can also some patterns to check input string is valid or not.

FOR MORE CLICK HERE