Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm going through a vulnerability remediation exercise for a client and am trying to figure out how to best mitigate this particular hole. There's a script on our site that calls up content into a new window using <%= %>. Essentially this takes a hard-coded link in an include file looking something like

<a href="/path/to/script?x=/path/to/linked/thing.img" target="">link</a>

and displays it on the resulting page within html using a script looking something like:

<img src="<% =request.querystring("x") %>">

This script is in hundreds of includes, so I'm trying to figure out the most efficient way of mitigating it. Should I use a find and replace to remove the script from the include files or is there a way to sanitize the actual script using something other than <%= %>?

The whole thing is legacy, super clunky and needs to be replaced anyway, but like I said, we're talking about hundreds of files here, and not all follow the same syntax so I can't run a batch find and replace for all of them. It'll have to be in small batches and I'll still have to go into each one to check if something broke. Kill me now.

I'm a designer/front-end dev, not a security expert (and not a JavaScript whiz either), so any help here would be much appreciated.

share|improve this question
    
Is this classic ASP? ASP.NET? –  Xander Mar 28 '13 at 18:49
    
Not sure but want to say asp.net –  kristina childs Mar 28 '13 at 18:59
    
Do you know what the page extensions are? Are they .asp, or .aspx, or something else, perhaps? –  Xander Mar 28 '13 at 19:07
    
Any asp files are simply .asp. Does this matter in this context, though? ASP isn't the only language running on this particular server. It's an amalgamation of things... a total mess really. Keeps me employed though, so I'm not complaining ;) –  kristina childs Mar 28 '13 at 19:14
    
It matters because it determines what you have available in terms of specific technical mitigation options, nothing more. –  Xander Mar 28 '13 at 19:17

1 Answer 1

up vote 1 down vote accepted

A simple way would be to create a white-list of characters, such as alphanumerical and forward slashes - and making sure the file exist on your local filesystem. You want to avoid having: <img src="javascript:..."> and such.

For this, I'd recommend making a function say sanitize() which filters out unwanted characters, and wrap each of these with it

<img src="<% =sanitize(request.querystring("x")) >">

Depending on your framework being used (ASP, Ruby, ...) maybe you could monkey patch the code, so that request.querystring() always returns a sanitized version.

share|improve this answer
    
I like the idea of a sanitization function. Should I be looking at something like Google Caja or is there a simpler method for this? –  kristina childs Mar 28 '13 at 19:47

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.