How to fix specific XSS issues in URL via php?

Question

I am using Netsparker community edition for checking my app for any general security holes. I'm getting a lot of following XSS probable issue areas:

my_php_file.php?nsextt=" stYle=x:expre/**/ssion(alert(9)) ns="

Code in my_php_file.php is not accepting any $_GET or $_POST parameters.

So how I am supposed to fix this sort of XSS problems if I'm not even using those $_GET or $_POST parameters?

Also in pages where I do use $_GET params I get this:

my_php_file2.php?id=" stYle=x:expre/**/ssion(alert(9)) ns="

I do filter all incoming params (for example id from last snippet):

trim(htmlspecialchars($_GET['id']));

And after all that I even run result of previous in preg to allow only digits in that id param.

Could someone would so kind and advise me what those XSS alerts are all about? How to approach them?

Answer 1

I suggest you read about defending against XSS. OWASP has good resources. You need to apply proper input validation to all input values, and properly escape all dynamic values that you insert into the output HTML document. There are many online resources on how to prevent XSS.

As far as your specific application, you haven't provided us enough information to diagnose the issue. Did you try opening my_php_file.php?nsextt="..." in your browser, to see what happens? Does an alert dialog pop up? If you view the source of the response, do you see a "style=..." attribute anywhere in the response? Also, though you say you don't use any GET parameters in my_php_file.php, is it possible that code in my_php_file.php might include another PHP file or might call some other function that produces unsafe output? I suspect you may have an XSS vulnerability that allows injection of a new attribute into the middle of some attribute list somewhere.

You mention the approach you are using to sanitize the parameters on other pages. I'd like to mention that this is not the proper input sanitization method. strip_tags does not prevent XSS (strip_tags is not guaranteed to remove all tags; and even if it did, removing all tags is not sufficient, as one can still mount an XSS attack by injecting attributes without injecting any new tags). A good rule of thumb is that if you're using strip_tags, you're probably doing something wrong.

More generally, input validation is not about blindly throwing every stripping function you can think of the data. Instead, you should check that the input matches a suitable whitelist or regexp, as appropriate for the type of the data. And, when you output the data, you should escape it in a way that is suitable for the context where the data will be inserted. For instance, if you are inserting it into the standard between-tag HTML context, you can escape the data with htmlescapechars. If you are inserting it as a link (as the value of a href attribute), then you need to ensure that it is a properly formatted URL with a safe scheme (http or https are safe; javascript is not). There's a lot more to say about input validation and output escaping: see the OWASP resources for a lot of great information on this topic.

Answer 2

For your first question, if you sure about your code not using $_GET or $_POST, then you should be fine. But are you using a framework or some other code ? Have you tried to access my_php_file.php?nsextt=hello%20world and search for "hello world" in the source? Maybe you forget some include that use $_GET['nsextt'] ?

(note : by passing var via the url in a browser, only $_GET will be used.)

Now, for the second part, instead of all those functions + preg to check if the input is an int, you should use the filter_var() functions in php :

$secure_integer = filter_var($_GET['id'], FILTER_SANITIZE_NUMBER_INT);

If you want, you can also just validate the input with FILTER_VALIDATE_INT instead of FILTER_SANITIZE_NUMBER_INT.

Answer 3

use this library to protect you against XSS attacks Google Code PHP-antixss and also their is a PHP functions called htmlspecialchars() that will help you a lot and you should know about it ,you can use OWASP XSS prevention cheat sheet as a guide also