Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm trying to change text links to real anchors. So for example I want to change http://example.com to <a href="http://example.com">http://example.com</a>.

Since this is a user given string, should I take special precautions to things like XSS (for example removing all < and >) or is this something I shouldn't care about in this situation? Anything other I need to keep in mind when building such a functionality?

share|improve this question
add comment

4 Answers

up vote 6 down vote accepted

If you're only trying to convert links, the safest option is to use sanitization and a whitelist. Basically a list of allowed values, which prevents anything you don't specify from being passed. Always use a reputable sanitization function and whitelist, I would not recommend building your own unless you know what you're doing. See a page like the following for reference (make sure all sanitization/validation is happening on the server side, of course):

http://jsoup.org/cookbook/cleaning-html/whitelist-sanitizer

I think the prospect of making your users use a markup language is a good suggestion for tag injected XSS, but it doesn't really address the issue of URI concat'd XSS.

I find the previous answerer's response of essentially saying that you should only prepare for simple attacks because otherwise you're "going down the rabbit hole" is reckless and naive, why don't we just put a simple lock on bank vaults in that case?

share|improve this answer
add comment

I do work on the side for an open source forum package, and the code has used a wonderfully complicated algorithm for converting typed URLs to links for the users too lazy to use the BBCode tags.

There have been many bug fixes, and there are still more than a few bugs left to fix - and the only conclusion I can come to is to not worry about auto-converting for the users. Make them use whatever markup language you allow - even that will have a few security issues, but it will be far fewer than trying to auto-parse URLs in text.

share|improve this answer
add comment

Are you trying to prevent XSS attacks against the other site? You can't predict how other sites will respond when a user clicks on a URL - regardless if it contains obvious scripting or even HTML markup. So trying to extract / sanitize stuff you know might be dangerous is just security by obscurity.

If you decide to proceed with this (a lot of sites do - it's in the nature of the web to provide links to other sites) then you only need to worry about attacks potentially directed at your own site - and simply ensuring that the URL is well-formed would be sufficient, but that's not a trivial task.

share|improve this answer
add comment

Validate only that your own site is protected against XSS (by HTMLEncode() or other method prior to display) ... you can't do much for anyone elses.

Given the ability for mailicous types of people to obfuscate the URL using HEX or other encoding methods - you're chasing down a rabbit hole trying to validate anything other than simple format.

See: http://stackoverflow.com/questions/1732348/regex-match-open-tags-except-xhtml-self-contained-tags for many reasons not to try and parse these.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.