1

I'm building a web app where users can make post which consist of an html doc. An user can change the document via the dev tool for example. So the document consists of literally any user input. I'm worried about XSS since I'm not experienced in this area. To prevent XSS injections, I'm using jsoup to parse the content. I made a custom white list but I'm not sure (well I doubt) I thought about everything.

I save the content like this :

public void setContent(String content){
    content = Jsoup.clean(content, WhiteList4jsoup.getWhiteList());
    this.content = content;
}

My jsoup whitelist is like this :

public static Whitelist getWhiteList() {
        Whitelist whiteList = Whitelist.basic();

        whiteList.addAttributes("h1", "style");
        whiteList.addAttributes("h2", "style");
        whiteList.addAttributes("h3", "style");
        whiteList.addAttributes("h4", "style");
        whiteList.addAttributes("h5", "style");
        whiteList.addAttributes("h6", "style");
        whiteList.addAttributes("h7", "style");

        whiteList.addAttributes("a", "href");
        whiteList.addAttributes("img", "src", "style");
        whiteList.addAttributes("div", "style", "aria-label");


        whiteList.addAttributes("table", "style", "rules", "border");
        whiteList.addAttributes("thead", "style");
        whiteList.addAttributes("th", "style");
        whiteList.addAttributes("tr", "style");
        whiteList.addAttributes("td", "style");

        // Those are customs tags that I insert in the document when user
        // clicks on a button. I Let them in so when I display the message content I can grab them tags with javascript and do some business with it.
        whiteList.addAttributes("customContainer", "type", "title", "measured");
        whiteList.addAttributes("columnCustom", "title", "value");
        return whiteList;
    }

Is any of this potentially dangerous ?

It's actually a wysiwyg editor in a iframe that I build myself so I've control over it. Since user can create charts, tables and such the result is quite messy with a mark up of my own. That's why I wanted a wysiwyg. However if it's too dangerous I'll go the same route as stackoverflow and do a preview at the bottom. I already finished my editor but I think the preview wouldn't take much effort.

If that is the case I don't intend to use any already available markup such as bbcode because my content is too much custom (images, links, charts from google api, tables). Is there anything I should watch out for if I'm building one ?

2

What you are trying to do is inherently pretty dangerous. I would strongly recommend using something like BBCode or Markdown, as these are specifically designed to allow fairly rich content without script injection risks (although bugs in them are sometimes found).

With that said, there's only two really obvious scripting risks I see in what you've posted here.

  1. <a href="javascript:alert('XSS!')">Click here!</a> will create something that looks like a "normal" hyperlink but will execute code within your site's origin (like an XSS) when clicked. You may notice that this doesn't work on StackExchange (which uses Markdown).
  2. You can embed scripting behavior in CSS. Very old versions of IE allowed the expression value in styles, which is just flat-out embedded script, but there's also a thing called "CSS Behavior` that allows attaching externally-specified scripts to elements. This is, in effect, the same as embedding script tags in the page.

Beyond that, though, allowing CSS in general is dangerous. Using CSS, a malicious user can completely overlay the page, changing or hiding certain content or even making the page look like something totally different from what it is.

  • Yeah I won't allow styles attributes. What about a class though ? For point 1. I tried but it didn't alert. The output on the page was : <a rel="nofollow">Click here!</a>. However normal links work. – Ced Sep 22 '15 at 23:42
  • Interesting, sounds like it checks the URI scheme for the <a> element. Good for it. As for classes, I think you're fine as long as you don't allow people to define their own class styles. – CBHacking Sep 23 '15 at 0:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.