sanitizing likes/unlikes in application?

Question

I've got a function in my app where users can click on a "thumbs up" image and a like is recorded in the database; all that's recorded is the user's ID and the ID of the post that the user liked.

I know user input can't be trusted--am sanitizing user inputs, validating user inputs (server-side), escaping outputs, and escaping db queries.

In this case, the user is clicking the image, but there is no form. However, data is being passed to the database, using JS. Note, there is no user input between any script tags (the like script is on a page that isn't served).

My plan is to validate (server-side) that only numbers are being sent to the database, but how do I sanitize this "like"/thumbs up input to protect against XSS?

Note: I'm currently reading through OWASP's XSS Prevention Cheat Sheet and Mozilla's Secure Coding Guidelines, which is how I started wondering about this.

Answer 1

Sanitation is trivial, as this variable can only be two values. You could make it an integer, and have a value of 1 for an up-vote and a value of -1 for a down vote, no other value is valid. Of course all security based validation must always be done server side.

But that is the least of your security concerns. The real concern is forcing other to vote on an attacker's behalf. This can happen a number of ways. An attacker could make a clickjacking game where by each time the user clicks to fire a rocket at some kind of space invader they are in fact clicking on an invisible iframe which is firing a new vote at your system.

An even more virulent attack would be to use Cross-Site Request Forgery (CSRF) to fire off these requests en-mass when one of your users visits an attackers website. The CSRF Prevention Cheat Sheet is a good resource.

Almost all Anti-CSRF measures are defeated by XSS, so make sure your entire website is immune to this attack. The Sammy Worm used XSS to defeat MySpace's Anti-CSRF token.

Also, don't forget about automatic account creation, make sure your users have to solve a strong captcha like Recaptcha before they can make an account. Email verification is trivial to automate and I don't believe its a real security measure. If they have too many failed logins they should also be prompted with a captcha.

Answer 2

Perhaps I'm misunderstanding your scenario, but the way I imagine it the sanitization should be fairly easy.

When a user thumbs up/thumbs down a post, there really only should be 2 values that are allowed as inputs - the up value, or the down value. For simplicity sake, I would just use 1 as Up, and 0 as Down. Then for your sanitation you just need to check that the value is either 1 or 0 (or, if you're more lax, that it is numerical).

In JS, simply do something like:

if(value !== 1 && value !== 0) {
    return false;
}

However, using JS as your only line of defense against XSS is a very bad idea. If someone wanted to send you bad data, they could simply use cURL to send you data while bypassing your javascript validation. I strongly suggest doing your validation server-side, and just use JS validation as a method to reduce the number of useless AJAX calls.