How to fix XSS in API Responses
in Dart Frog
Executive Summary
Dart Frog's simplicity can be a double-edged sword. When building API endpoints that reflect user input, failing to enforce strict Content-Types or neglecting output encoding allows attackers to bypass the same-origin policy via reflected XSS. If an endpoint returns 'text/html' with unsanitized data, the browser will execute any injected scripts in the context of your application.
The Vulnerable Pattern
import 'package:dart_frog/dart_frog.dart';Response onRequest(RequestContext context) { final params = context.request.uri.queryParameters; final userId = params[‘id’] ?? ‘unknown’;
// VULNERABLE: Reflecting raw input in an HTML context return Response( body: ‘User ID: $userId’, headers: {‘Content-Type’: ‘text/html’}, ); }
The Secure Implementation
The vulnerability exists because the 'id' parameter is concatenated directly into a string served with a 'text/html' header. An attacker providing '?id=' triggers execution. To remediate: 1) Prefer 'Response.json()' which sets 'application/json' and prevents the browser from sniffing the response as HTML. 2) Utilize the 'html_escape' package to neutralize dangerous characters like <, >, and &. 3) Implement a strict Content-Security-Policy (CSP) header to restrict script sources.
import 'package:dart_frog/dart_frog.dart'; import 'package:html_escape/html_escape.dart';Response onRequest(RequestContext context) { final params = context.request.uri.queryParameters; final userId = params[‘id’] ?? ‘unknown’;
// FIX 1: Use proper JSON responses for APIs // FIX 2: If HTML is required, escape all dynamic content const htmlEscape = HtmlEscape(); final safeId = htmlEscape.convert(userId);
return Response.json( body: { ‘status’: ‘success’, ‘user_id’: safeId, ‘display’: ‘User ID: $safeId’ }, ); }
Your API Responses API
might be exposed to XSS
74% of API Responses apps fail this check. Hackers use automated scanners to find this specific flaw. Check your codebase before they do.
Free Tier • No Credit Card • Instant Report
Verified by Ghost Labs Security Team
This content is continuously validated by our automated security engine and reviewed by our research team. Ghost Labs analyzes over 500+ vulnerability patterns across 40+ frameworks to provide up-to-date remediation strategies.