title: Blacklist/whitelist for XSS
body: <p>I need to implement XSS defence and I have troubles with it.
  I read this cheatsheet
  <a href="https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html" rel="nofollow noreferrer">https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html</a>
  There are a lot of valuable information, but Its fairly difficult for me to implement this.
  I understand, you need to escape untrusted data, I already implemented it in my application, but I need to also implement some kind of blacklist/whitelist, right? What is allowed in the data and what is not allowed.
  I tried to use this code on my server side (which is java), but I would need to something similiar on the front-end side. I am using core javascript and jquery</p>
  
  <ol>
  <li>Is it a good approach?</li>
  <li>Is there any library which could help me to build blacklist/whitelist?</li>
  <li>Or how can I make sure that escaped data does not contain for example javascript: etc? </li>
  <li><p>I found this library for escaping characters. 
  <a href="https://github.com/YahooArchive/xss-filters/wiki" rel="nofollow noreferrer">https://github.com/YahooArchive/xss-filters/wiki</a> Is it ok to use it? </p>
  
  <pre><code>    // Avoid anything between script tags
      Pattern scriptPattern = Pattern.compile("&lt;script&gt;(.*?)&lt;/script&gt;", Pattern.CASE_INSENSITIVE);
      value = scriptPattern.matcher(value).replaceAll("");
  
      // Avoid anything in a src='...' type of expression
      scriptPattern = Pattern.compile("src[\r\n]*=[\r\n]*\\\'(.*?)\\\'", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
      value = scriptPattern.matcher(value).replaceAll("");
  
      scriptPattern = Pattern.compile("src[\r\n]*=[\r\n]*\\\"(.*?)\\\"", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
      value = scriptPattern.matcher(value).replaceAll("");
  
      // Remove any lonesome &lt;/script&gt; tag
      scriptPattern = Pattern.compile("&lt;/script&gt;", Pattern.CASE_INSENSITIVE);
      value = scriptPattern.matcher(value).replaceAll("");
  
      // Remove any lonesome &lt;script ...&gt; tag
      scriptPattern = Pattern.compile("&lt;script(.*?)&gt;", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
      value = scriptPattern.matcher(value).replaceAll("");
  
      // Avoid eval(...) expressions
      scriptPattern = Pattern.compile("eval\\((.*?)\\)", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
      value = scriptPattern.matcher(value).replaceAll("");
  
      // Avoid expression(...) expressions
      scriptPattern = Pattern.compile("expression\\((.*?)\\)", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
      value = scriptPattern.matcher(value).replaceAll("");
  
      // Avoid javascript:... expressions
      scriptPattern = Pattern.compile("javascript:", Pattern.CASE_INSENSITIVE);
      value = scriptPattern.matcher(value).replaceAll("");
  
      // Avoid vbscript:... expressions
      scriptPattern = Pattern.compile("vbscript:", Pattern.CASE_INSENSITIVE);
      value = scriptPattern.matcher(value).replaceAll("");
  
      // Avoid onload= expressions
      scriptPattern = Pattern.compile("onload(.*?)=", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
      value = scriptPattern.matcher(value).replaceAll("");
  </code></pre></li>
  </ol>