Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Is it safe (in terms of XSS vulnerability) to get a parameter X from the user, escape its double-quotations and insert it as href?

Pseudo-code:
Y = escape_double_quotes(X);
print '<a href="http://' + Y + '">link</a>'
share|improve this question

migrated from stackoverflow.com Apr 2 '13 at 20:38

This question came from our site for professional and enthusiast programmers.

1 Answer 1

(The following answer is based on the assumption that escape_double_quotes() only escapes quotation marks.)

It depends on whether the user who is providing the parameter is different from the user who is seeing the link. If a user A is providing the parameter, but another user B may see the resulting link, then user A might maliciously insert a link to exploit user B. Consider the following example:

www.example.com/transfer_money.php?src=userB&dest=userA, which would result in:

print '<a href="http://www.example.com/transfer_money.cgi?src=userA&dest=userB">link</a>'

Another example:

></a><a href=javascript:myfunc(), which results in:

print '<a href="http://" ></a><a href=javascript:myfunc()>link</a>'

share|improve this answer
    
In such a scenario, the link is not considered to be the vulnerability. The attack should (and must) be defended using CSRF tokens. Good try, though! :D –  SeMeKh Mar 24 '13 at 20:38
    
See the new example. –  Jared Ng Mar 24 '13 at 21:51
    
Oops, my bad, I had a typo in the pseudo-code. Your second example won't work either. –  SeMeKh Mar 24 '13 at 22:15
2  
With your edited pseudo-code, assuming a correct implementation of escape_double_quotes(), I don't see a glaringly easy exploit. That being said, I don't see why you wouldn't just escape all potentially dangerous characters. An exploit may be possible if, for instance, a browser attempts to be helpful and "fixes" what it sees as broken anchor tags. –  Jared Ng Mar 25 '13 at 0:24

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.