1

We have a web app and we send the back URL through post to various pages to enable users come back to the parent.

The double quotes are translated to " to avoid XSS and then translated back. The final tag is like this - form name="back_url" action="server side script" method="post". These double quotes are creating the "Token contains a reflected XSS vector" error. Once I remove the double quotes like form name=back_url action=server side script method=post , the back button works. This issue is only in Chrome. Not sure how to resolve this.

Improve this question
1
  • Please could you clarify a bit - Could you add your actual form as code in your question? Why are you converting to quot; and then back again?
    – SilverlightFox
    Commented Aug 22, 2015 at 7:40

1 Answer 1

Reset to default
1

You should use URL encoding not HTML encoding. If you URL encode the back_url parameter the quotes shouldn't trigger any XSS warnings and you won't need to deal with converting them back and forth to make the redirect work correctly.

Also be wary that this design introduces an open redirect vulnerability into your application. An attacker can craft a URL for your website that redirects to an attacker controlled site when they use the back button if you're not properly sanitizing the back_url parameter.

Improve this answer
2
  • Grammar is hard in the morning. : )
    – Justin Moore
    Commented Aug 19, 2015 at 14:41
  • URL encoding should only be used in the path and query string parts or the URL. Technically you should URL encode and then HTML encode, however URL encoding usually gets rid of the HTML characters that allow escaping.
    – SilverlightFox
    Commented Aug 22, 2015 at 7:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .