2

I am upgrading the security of an existing site (so can't redo everything with a framework that has xss functions built in), so I am looking for a way to protect against XSS attacks such as the ones listed by OWASP here.

At the moment I use htmlspecialchars($text, ENT_QUOTES, 'UTF-8'); for output into HTML, json_encode for JS and HTMLPurifier for data containing HTML tags but am concerned this is not enough/correct. I am looking for a function that I can use like:

<div><?php echo escape_for_html($text); ?></div>
<img src="<?php echo escape_for_attribute($text); ?>">

After some research it seems solutions like xss_clean, ESAPI and PHPSEC are either no longer being maintained or not recommended. How can I protect against xss when echoing into tag attributes (including urls), JavaScript and CSS?

Improve this question
7
  • From a security perspective, one encoding method can cover both HTML and Attributes. From a user-friendliness perspective using separate escape methods for HTML vs Attributes allows you to include <br/> or &nbsp;s in one place, and not in the other. However, if you were to use white-space: pre-wrap in your CSS that would not be necessary, and you could revert back to a shared encoding function.
    – 700 Software
    Jul 13, 2016 at 16:43
  • When encoding JSON, be sure that </script is replaced with <\/script. (case insensitive) This is very important.
    – 700 Software
    Jul 13, 2016 at 16:46
  • Be sure that you carefully consider the risks for each attribute. For example, allowing a custom href is just as dangerous as allowing a custom onclick. (XSS) In such cases, it is important restrict the input, not just encode it. For plain text, such as the title attribute, this is not an issue.
    – 700 Software
    Jul 13, 2016 at 16:47
  • @GeorgeBailey Would running the input through a filter_var($input, FILTER_VALIDATE_URL); cover the custom href to make sure its an url and not script? Then through htmlspecialchars as normal.
    – iguanaman
    Jul 13, 2016 at 16:59
  • @iguanaman, I am not familiar with PHP. Since that is a question about a specific function, and a single specific encoding needed you could ask on StackOverflow. On the other hand, for understanding all the encodings you might need, and more general suggestions on securing your application, it is better to use Security Stack Exchange.
    – 700 Software
    Jul 13, 2016 at 17:55

1 Answer 1

Reset to default
1

Apart from other mitigation techniques, do consider using Content-Security-Policy (CSP) to prevent against XSS vulnerabilities.

CSP

Content Security Policy (CSP) is a computer security standard introduced to prevent cross-site scripting (XSS) : Wikipedia

It white-lists the domains from which a resource can be loaded. (resource could be : js, css, image etc) You can add this policy in the response header, and browser will enforce it during any attempt to load resources.
It also comes with report-only mode, which can be used to evaluate the current state of your application before enforcing it.

A sample policy looks like : 

Content-Security-Policy: script-src 'self' https://abc.com

With above policy, it will only allow to download javascript from page's current origin and abc.com. Any attempt to download from other source will cause an error like below in browser console : 

Refused to load the script 'http://evil.com/evil.js' because it violates the following Content Security Policy directive : "script-src 'self' https://abc.com".

Do note that it's only supported by major browsers; like : Chrome, Edge, etc.
Similar restrictions can be applied to other resources as well. For further reading, here is an awesome article explaining everything you need to know about CSP : https://www.html5rocks.com/en/tutorials/security/content-security-policy/

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .