|
I'm trying to change text links to real anchors. So for example I want to change Since this is a user given string, should I take special precautions to things like XSS (for example removing all < and >) or is this something I shouldn't care about in this situation? Anything other I need to keep in mind when building such a functionality? |
||||
|
|
|
If you're only trying to convert links, the safest option is to use sanitization and a whitelist. Basically a list of allowed values, which prevents anything you don't specify from being passed. Always use a reputable sanitization function and whitelist, I would not recommend building your own unless you know what you're doing. See a page like the following for reference (make sure all sanitization/validation is happening on the server side, of course): http://jsoup.org/cookbook/cleaning-html/whitelist-sanitizer I think the prospect of making your users use a markup language is a good suggestion for tag injected XSS, but it doesn't really address the issue of URI concat'd XSS. I find the previous answerer's response of essentially saying that you should only prepare for simple attacks because otherwise you're "going down the rabbit hole" is reckless and naive, why don't we just put a simple lock on bank vaults in that case? |
|||
|
|
|
I do work on the side for an open source forum package, and the code has used a wonderfully complicated algorithm for converting typed URLs to links for the users too lazy to use the BBCode tags. There have been many bug fixes, and there are still more than a few bugs left to fix - and the only conclusion I can come to is to not worry about auto-converting for the users. Make them use whatever markup language you allow - even that will have a few security issues, but it will be far fewer than trying to auto-parse URLs in text. |
|||
|
|
|
Are you trying to prevent XSS attacks against the other site? You can't predict how other sites will respond when a user clicks on a URL - regardless if it contains obvious scripting or even HTML markup. So trying to extract / sanitize stuff you know might be dangerous is just security by obscurity. If you decide to proceed with this (a lot of sites do - it's in the nature of the web to provide links to other sites) then you only need to worry about attacks potentially directed at your own site - and simply ensuring that the URL is well-formed would be sufficient, but that's not a trivial task. |
|||
|
|
|
Validate only that your own site is protected against XSS (by HTMLEncode() or other method prior to display) ... you can't do much for anyone elses. Given the ability for mailicous types of people to obfuscate the URL using HEX or other encoding methods - you're chasing down a rabbit hole trying to validate anything other than simple format. See: http://stackoverflow.com/questions/1732348/regex-match-open-tags-except-xhtml-self-contained-tags for many reasons not to try and parse these. |
|||
|
|
