Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've got a function in my app where users can click on a "thumbs up" image and a like is recorded in the database; all that's recorded is the user's ID and the ID of the post that the user liked.

I know user input can't be trusted--am sanitizing user inputs, validating user inputs (server-side), escaping outputs, and escaping db queries.

In this case, the user is clicking the image, but there is no form. However, data is being passed to the database, using JS. Note, there is no user input between any script tags (the like script is on a page that isn't served).

My plan is to validate (server-side) that only numbers are being sent to the database, but how do I sanitize this "like"/thumbs up input to protect against XSS?

Note: I'm currently reading through OWASP's XSS Prevention Cheat Sheet and Mozilla's Secure Coding Guidelines, which is how I started wondering about this.

share|improve this question
    
I read your question is preventing attacks rather than sanitizing (because you mentioned XSS). So i answered that. If you want to literally know what values to post its 1/0/-1 for likes/unlike/dislike + the id of the item + the cookie/httponlycookie mentioned in my answer –  acidzombie24 May 20 '12 at 4:07
add comment

3 Answers

up vote 5 down vote accepted

Sanitation is trivial, as this variable can only be two values. You could make it an intiger, and have a value of 1 for an up-vote and a value of -1 for a down vote, no other value is valid. Of course all security based validation must always be done server side.

But that is the least of your security concerns. The real concern is forcing other to vote on an attacker's behalf. This can happen a number of ways. An attacker could make a clickjacking game where by each time the user clicks to fire a rocket at some kind of space invader they are in fact clicking on an invisible iframe which is firing a new vote at your system.

An even more virulent attack would be to use Cross-Site Request Forgery (CSRF) to fire off these requests en-mass when one of your users visits an attackers website. The CSRF Prevention Cheat Sheet is a good resource.

Almost all Anti-CSRF measures are defeated by XSS, so make sure your entire website is immune to this attack. The Sammy Worm used XSS to defeat MySpace's Anti-CSRF token.

Also, don't forget about automatic account creation, make sure your users have to solve a strong captcha like Recaptcha before they can make an account. Email verification is trivial to automate and I don't believe its a real security measure. If they have too many failed logins they should also be prompted with a Capthca.

share|improve this answer
    
thank you for this answer. Accepted and upvoted. This is exactly what I was looking for. I hadn't heard about this clickjacking stuff, but will check it out, along with the CSRF cheat sheet (had it bookmarked). Codeigniter has built-in CSRF protection which I'm using, but I'm also reading about it and reviewing the code to learn as much as possible. Appreciate the rest of your advice also. –  chowwy May 18 '12 at 2:15
2  
+1 for the clickjacking, something new for me. –  lucho May 18 '12 at 6:39
add comment

Perhaps I'm misunderstanding your scenario, but the way I imagine it the sanitization should be fairly easy.

When a user thumbs up/thumbs down a post, there really only should be 2 values that are allowed as inputs - the up value, or the down value. For simplicity sake, I would just use 1 as Up, and 0 as Down. Then for your sanitation you just need to check that the value is either 1 or 0 (or, if you're more lax, that it is numerical).

In JS, simply do something like:

if(value !== 1 && value !== 0) {
    return false;
}

However, using JS as your only line of defense against XSS is a very bad idea. If someone wanted to send you bad data, they could simply use cURL to send you data while bypassing your javascript validation. I strongly suggest doing your validation server-side, and just use JS validation as a method to reduce the number of useless AJAX calls.

share|improve this answer
    
Appreciate your response; my question is around sanitizing non-form inputs in a JS function--I'm not using PHP for this function, and have already sanitized inputs for those. –  chowwy May 18 '12 at 0:36
    
I noticed your edit; appreciate it, but I don't need help with the JS function, it's already working. –  chowwy May 18 '12 at 0:41
1  
Updated code to JS. But, please keep in mind the security warning. Validation in JS is not a safe alternative to server-side validation –  jwegner May 18 '12 at 0:41
    
My question specifically says that I am using server-side validation! –  chowwy May 18 '12 at 0:42
    
My apologies - I thought you meant server-side just for the form-based values. You should be good then :) –  jwegner May 18 '12 at 0:43
show 2 more comments

Have an httpcookie called something like session and another cookie submitted in the POST data called whatever you want. Validate both. Essentially if a person tries changing the user id the httponly cookie will stop them (because they can not steal it with javascript). If the attacker generates a page and has the user submit a form/post the cookie will stop them because the attacker can not know what the value is and is not submitted automatically as cookies are.

clickjacking are another attack. The simpliest solution is to check if it is in an iframe. Here is how to do it in javascript. window.location != window.parent.location //true if in iframe. If you need iframe support than you can't really do anything to stop attacks. You could try doing something with your UI so the attacker cant guess where to overlap things (example every user could have 1 of 3 UI types and have dislike where like is for other users) but that could annoy your users. I believe this is more of a browser security problem than yours. Some idiotic sites/article/people say users should disable javascript but that is silly and would in fact ruined iframe detection. Regular buttons that user click which post a form/page require no js would fall to the same problem. I would recommend having javascript, checking and post it over ajax than using form post.

share|improve this answer
    
Does anyone want to explain the -1? –  acidzombie24 May 21 '12 at 5:53
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.