Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Is there a proven library with functions for preventing XSS attacks? Many people don't realise that htmlspecialchars is not enough to prevent XSS attacks. There are various contexts that need their own escaping (html properties, Javascript, more?). Is there a proven library that will provide functions for me to escape in all of these contexts?

share|improve this question
    
How is htmlspecialchars not enough? Can you show an example? –  Billy ONeal Nov 10 '11 at 2:26
2  
@Billy blog.kotowicz.net/2011/10/… htmlspecialchars is not context-aware,it's only good to escape in simplest "html element content" context –  Krzysztof Kotowicz Nov 10 '11 at 6:04
    
Yes, many people write bad code. And the reason why there are multiple different functions within PHP for changing the representation of character data is because there are many places PHP can put that data - into SQL statements, XML documents, CSV files, HTML, URls, Javascript.... TNEF comes close as a magic bullet - but at the cost of making your data totally unintelligible to inspection/processing without changing back to a different representation. –  symcbean Nov 10 '11 at 10:11
    
@Krzysztof Kotowicz: I don't see anything about htmlspecialchars in that blog post. Obviously if you're embedding a string in a script or something then you'll have to use an appropriate escaping function. But I can't think of an input to htmlspecialchars that would result in broken behavior. Of course if there's embedded javascript in a link you're subject to that. But I can't really think of a case where that results in a security problem... –  Billy ONeal Nov 10 '11 at 16:42
1  
@BillyONeal .. and that is the whole point. You asked for example where htmlspecialchars is not enough (for XSS protection). It can't protect you in all contexts just like you noticed, and that is why Casebash asks for additional functions (because PHP leaves you with only incomplete solution like htmlspecialchars). –  Krzysztof Kotowicz Nov 10 '11 at 17:01

3 Answers 3

Instead of using context-aware escaping (probably there are various PHP libraries that try to go this way) I'd recommend using full HTML XSS-aware parser that will create a document tree and will allow only chosen whitelisted elements, attributes etc.

Projects that go with this approach are HTMLPurifier and Wibble. For example, Wibble:

  • Converts all HTML input to HTML safe UTF-8
  • Loads the HTML into a DOMDocument object
  • Applies one or more filters (DOM manipulators) to the HTML DOM
  • Extracts the filtered HTML from DOM and applies HTML Tidy (ext/tidy)
  • Converts the final HTML to the user's selected character encoding (if not UTF-8)

There is no place for a malicious code coming from almost-valid HTML syntax to pass through this. If there's anything wrong with the HTML, it would most likely be your incomplete whitelist (or some weird html/tidy attack vector, but I doubt it).

Update: If you don't need full-blown HTML parser, another option is to use secure-by-default templating engine. The only PHP project with context-aware escaping I know is Nette Latte templating engine, I didn't use it though. Other engines also have different escaping techniques, but you need to specify context by yourself (and if you omit the context once, you're open to XSS attacks). Examples are Twig or Smarty. You can just take the escaping code out of those to use it outside templating engine.

share|improve this answer
2  
"HTML Purifier 4.3.0 is a major security release addressing various security vulnerabilities related to user-submitted code and legitimate client-side scripts." When did htmlspecialchars had a security release? –  curiousguy Nov 9 '11 at 23:25
1  
There are situations where HTML parsers are useful - for example, these are the only reliable solution when allowing the user to enter their own HTML, but I don't want to use this everywhere I interpolate a variable. It is just too heavy-weight. –  Casebash Nov 10 '11 at 6:07
1  
Not in a few last years I suppose,because it's just a simple str_replace equivalent function that does not offer xss protection in all cases,because it's not context-aware. –  Krzysztof Kotowicz Nov 10 '11 at 6:08
    
+1 to Krzysztof. @curiousguy You do understand that htmlspecialchars doesn't protect against XSS in many situations, right? You should definitely read this owasp.org/index.php/… This is what everyone is talking about when they say "context" –  Cheekysoft Nov 11 '11 at 14:09
1  
The problem with using HTMLPurifier or Wibble is that they will block all use of Javascript and other stuff, not only from untrusted users, but also from the trusted owner of the website -- these libraries make no distinction between the two. Many website authors legitimately need Javascript and CSS on their web page. Thus, they can't simply apply HTMLPurifier/Wibble to every dynamically generated page. HTMLPurifier is more useful when you want to allow untrusted users to provide HTML markup: e.g., for a Wiki, or to let the user leave a comment, etc. –  D.W. Nov 13 '11 at 3:19

The best solution against XSS is having programmers understand how data can be dangerous, and use context-aware escaping when they output data. Always. Makes the programmers think more about what they're doing, and gives you more robust programs. I see no problem with that approach :-)

share|improve this answer
    
But you may as create functions for each context. But, it would seem like someone else would have already created such functions and reinventing the wheel would be kind of pointless –  Casebash Nov 10 '11 at 12:02
    
I'm not saying programmers should create their own functions. On the contrary, they should use those available. But to understand where to use which function, you need to think about where data comes from and where it is going. –  chris Nov 10 '11 at 15:25
    
@Casebash I would advocate the reinvent-the-wheel-so-that-you-know-how-to-do-so approach. (And then you can just use the standard component.) –  curiousguy Nov 13 '11 at 6:33

Yes, there are several such libraries. The choice of library depends upon what language/web programming framework you are using.

First, you need to start by reading about XSS. I recommend the following document:

Next, once you have familiarized yourself with that, I can point you to a few libraries that provide well-tested escaping functions:

However, let me warn you that using these functions properly requires developer knowledge, and is potentially error-prone. There are many different parse contexts where dynamic data might be injected into HTML, CSS, or Javascript content; each parse context may require a different escaping function (or sequence of escaping functions) be applied. The developer needs to make sure to apply the correct escaping function(s) each time he/she injects dynamic data into such content. This requires knowledge of the XSS risks and how to defend against them.

This approach (manually escaping data everywhere it is used) is also error-prone. It is easy to forget to apply an escaping function. If you have 100 places where you include dynamic data in the document, it would be easy to remember in 99 places and inadvertently forget to escape in one of them. We're only human, and those kinds of mistakes are easy to make. Libraries of escaping functions don't help developers avoid this problem.

A better solution is to use a web programming framework that helps developers avoid this problem. The state-of-the-art is context-sensitive auto-sanitization. This works particularly well with frameworks that provide a HTML templating system. In such a system, the template engine is responsible for automatically escaping all non-static data that is interpolated into the template. Because the template engine can identify the parse context where the data is being dynamically inserted, the template engine can automatically select and apply the proper escaping function.

The primary issue with context-sensitive auto-sanitization is that only a few web programming frameworks currently support it. Some web frameworks that do support context-sensitive auto-sanitization: Google Ctemplate (Closure templates), GWT, Google Clearsilver.

For more on this topic, I can highly recommend the following research paper:

share|improve this answer
    
Thanks for your answer. This question is asking specifically about PHP and unfortunately ESAPI isn't production ready yet. The project I am working on unfortunately utilises a custom templating system and it is infeasible to switch everything over to a newer and better system. That research paper looks useful –  Casebash Nov 12 '11 at 0:24

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.