Minimum size of input text box required for XSS attacks

Question

I have below code to accept User login ID as input from User.

<input name="userName" type="text" id="userID" maxlength="8"/></td>

Maximum number of characters that a end user can input is 8 here. If one has to carry out XSS attack like this by entering below code in input box,

<script type="javascript>hello</script> ,

which cannot be entered because of maxlength restriction, can I be assured that XSS attack of this category cannot be done?

In general, if input is restricted by maxlength, what is the minimum maxlength once should give to restrict XSS attack?

Answer 1

Your solution doesn't prevent any XSS attack. The HTML input tag attribute maxlength is an instruction to the web browser, that a malicious attacker can trivially change in any modern browser by dynamically altering the DOM.

<input name="userName" type="text" id="userID" maxlength="8"/>

Your sanitation routines have to be done with server-side code. That is this type of sanitation could be done if you truncate any input that's longer than ~8 characters when in your server-side code (not in the HTML attribute that a client can easily modify). Beware that html/js is quite forgiving (and you'd have to test all browsers), so once you get to lengths of more than len(<script>) ~ 8, I think this mechanism likely could fail for some clever use with some bad browsers.

However, this is still an inane route to preventing XSS (unless the only data your application will ever take and possibly ever display back to any user is 8 characters and your server side code truncates this user input at ~8 char). You really need to either:

• Run through a well-known HTML sanitizer/purifier that you didn't write yourself or

• First escape all the special html characters in user input ("&'<> to their HTML escaped versions: "&'<>) and then apply rules of a safe lightweight markup language (like reddit markdown) to only allow safe things like links [links](http://example.com) (checking the protocol is in your safe whitelist e.g., http/https/ftp) or italicized (*italicized*) or bold (**bold**) text.

Answer 2

This is no protection against XSS. This is because the maxlength is restricted on the client side which can be changed.

E.g. if I use the developer tools of a browser and change the maxlength on the fly I can enter and submit longer strings to the server.

So don't use such attributes as a protection.

If someone wants to inject some XSS he will chose such a way to circumvent all client side protection measures.