Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm not aware of all the xss tricks..

While programming in Ruby on Rails, using a sanitize method to allow only certain tags and it makes its best to clear all the other tags and scripts

the remaining tags are

    "small", "dfn", "sup", "sub", "pre", "blockquote", "ins", "ul", "var", "samp", "del",
 "h6", "h5", "h4", "h3", "h2", "h1", "span", "br", "hr", "em", "address", "img", "kbd",
 "tt", "a", "acronym", "abbr", "code", "p", "i", "b", "strong", "dd", "dt", "dl", "ol",
 "li", "div", "big", "cite"

Is it possible to create an XSS attack with a combination of these tags?

share|improve this question
    
you accepted the first answer after a few minutes. lame. –  Rook Dec 3 '12 at 16:37

4 Answers 4

up vote 7 down vote accepted

Yes. It's trivial.

<div onmouseover="alert(1)" style="position:fixed;left:0;top:0;width:9999px;height:9999px;"></div>

Might want to save your work before trying that, though - the alert might show repeatedly as you move your mouse across the screen.

Of course, a better attack would involve destroying the div as soon as the JavaScript is called, in order to make it look legitimate.

You should escape all output in order to avoid this.

share|improve this answer
    
is it possible if " is escaped? –  Nick Ginanto Dec 3 '12 at 16:21
    
Yes, they can just use ' instead. Or they could exploit unicode parsing tricks to inject a " or ' character. –  Polynomial Dec 3 '12 at 16:22
1  
@Nick Ginanto yes onmouseover=alert(1) –  Rook Dec 3 '12 at 16:25
    
Ah, yes, they could just do that instead, too. –  Polynomial Dec 3 '12 at 16:26
    
onmouseover requires user interaction, onerror fires on pageload. –  Jacco Jan 10 '13 at 10:46

For a good 'cheat sheet' containing a number of HTML XSS attacks, see here: OWASP.org They get quite creative. It is worth using that sheet to test your site as it's constructed and to check back from time to time as that list is updated.

Hope it helps!

share|improve this answer

Yes, almost all HTML tags allow you to declare an event handler. Some of these events could be triggered when the page loads without user interaction:

<img src=x onerror=alert(1) />

Event tags are not the only way to trigger xss:

<a href=javascript:alert(1)>xss</a>

One possilbe solution is to set the Content Security Policy for this page

X-Content-Security-Policy: unsafe-inline

Just make sure to actually test your solution. Don't take anyone's word. (Also the CSP is new)

Another option is PHP's HTMLPurifer which is more advanced than Ruby's Sanitize.

share|improve this answer
    
is there a comparison for htmlpurifier vs ruby sanitize? how do you know it is more advanced? –  Nick Ginanto Dec 3 '12 at 16:54
    
@Nick Ginanto nope, and read the docs they are very different. –  Rook Dec 3 '12 at 16:55
    
+1 for the OnError trick. –  Polynomial Dec 3 '12 at 17:00

Yes: <img onerror=alert(document.cookie) src=1 />

The requirements for output escaping vary based on location in the document. Text that is meant to be in an HTML attribute must be escaped differently ('") than text intended to be in an HTML element (<>), for example. The OWASP Enterprise Security API (ESAPI) is a good way to handle this, since it provides escaping mechanisms for all the different contexts. The Ruby version can be found on Github.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.