3

I'm scanning HTML before it reaches a browser, and I've just heard about a type of exploit that uses invalid UTF7 or UTF8 sequences to embed an otherwise invisible script tag, which is used to execute arbitrary code.

I have never seen such a sequence myself and I am curious what it looks like, so that I can do a simple strstr call to locate them.

Thanks for any help.

2 Answers 2

1

Your first line of defence should be input sanitization. In other words, make sure that you only accept valid UTF-8 or whatever other format you are expecting.

Going the route of string replacement is based on black-listing. Black-listing is always one step behind and, because of this, won't work. Your second line of defence (after sanitizing) should be White-listing instead.

1
  • 1
    Exactly. I would like to add that, even if you would have a perfect XSS-detector, you shouldn't be filtering input anyway. What if, say, a user wants to use a < somewhere or demonstrate some Javascript? Instead you should see text and HTML as two different things; and whenever you want to include some form of text into your page, you'll have to 'convert' it to HTML (by using an escape function that only accepts UTF-8) first. Jun 30, 2012 at 21:14
0

Perhaps the following link will aid you:

XSS CheatSheet

It is a cheatsheet that contains a lot of XSS examples including UTF ones.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .