We are developing code for a Banking web application. We want to make sure that the code is secure and since we are using a lot of javascript code, we are kind of worried if any chance of a web based attack can surface. Can someone please look into the code below and comment if any attack could be possible by an attacker? The below code is within a jsp page.

window.location.href = document.getElementById("st_val").value

st_val

is a hidden field on the form which contains either of 3 values, that is used by the Java code on the backend to decide on a logic.

  • We don't tend to do code reviews. There's another site for that. The other big question in your code becomes "what happens when the id value is not one of the 3 expected ones?" – schroeder Nov 11 '15 at 0:25
  • 2
    @schroeder - is this a new policy? I feel like i've seen a million questions like this and they are usually pretty well received. – Abe Miessler Nov 11 '15 at 0:36
  • If it isn't one of the three values, we are setting the boolean flag to null. Its only a small logic. Java code handles this. – Haunted Nov 11 '15 at 14:50

This won't be problem as long as st_val is NOT under the client control. As you know, if you are setting value of the window.location.href variable it will redirect current page to the new value. If attacker set javascript:alert(1) value to the st_val this will be end up with DOM XSS.

For example;

<html>
<meta charset="utf-8"/>
Hello
<script>
function onSubmit(){
        window.location.href = document.getElementById("st_val").value;
}
</script>
        <input type="hidden" id="st_val" value="<?php echo (isset($_GET['pay']) ? $_GET['pay'] : '')?>">
        <input type="submit" value="Submit" onclick="return onSubmit();">
</html>

Attacker sends following request. http://domain.com/xss/href.php?pay=javascript:alert(1)

alert(1) function will be called immiadetly when you clicked on submit button.

In conclusion, it's safe to use window.location.href as long as values comes from your backend, without client decision!

  • Thank you, Mehmet. This cleared up a bit for me. st_value is something that is coming from the backend. We are setting its value. I hope this must be fine. From what I understand, as long as the value is not set using request parameters that are controlled by the user, we must be fine. It makes sense. :) – Haunted Nov 11 '15 at 14:48
  • And whatever input you are taking from client using request parameters must be sanitized and validated. – Krishna Pandey Nov 12 '15 at 5:55

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.