Encode, decode, and sanitize HTML in BoxLang with ESAPI.
npx skills add https://github.com/ortus-boxlang/skills --skill bx-esapi
Please help me install this Agent Skill. Skill: bx-esapi Source: https://github.com/ortus-boxlang/skills/tree/main/boxlang-modules/bx-esapi Command: npx skills add https://github.com/ortus-boxlang/skills --skill bx-esapi
Prevents cross-site scripting and injection by offering ESAPI-based encoding, decoding, and HTML sanitization in BoxLang, enabling safe rendering of user input.
Call encodeForHTML on user input before rendering it into HTML to prevent XSS.
High-intent search queries and answers about installing and using this skill.
To prevent XSS in BoxLang, call encodeForHTML on user input before rendering it into HTML content. This ESAPI-based encoding mitigates cross-site scripting by safely escaping dangerous characters in the rendered output.
ESAPI encoding in BoxLang supports HTML attributes, inline JavaScript, CSS, URLs, SQL, XML, and LDAP contexts. It provides robust context-aware encoding across these multiple injection vectors to ensure safe data rendering.
Yes, you can sanitize untrusted HTML using the htmlSanitize function with AntiSamy support. It strips dangerous content from user input using built-in rules or optional custom policy files for safe rendering.
Yes, BoxLang ESAPI supports decoding and canonicalization through decodeFromHTML and decodeFromURL operations. These functions safely handle the reversal of encoded strings back to their original forms.
Policy files are optional for ESAPI sanitization in BoxLang. The htmlSanitize function offers built-in AntiSamy support by default, but allows you to supply custom policy files when stricter content filtering rules are required.
latestaiagentsGuide output encoding, input sanitization, and CSP implementation to prevent XSS.
anishi1222Detect SQL injection vulnerabilities from string concatenation and unparameterized queries.
ortus-docsRender dynamic HTML from .bxm templates using BoxLang expressions.
llmh333Enforce taint-aware input handling and secure Perl file, process, and DBI operations.
