1

I recently noticed that there is a XSS security flaw on my website. I made my own search engine and after redirecting to the result page the users' input was executed. I made a solution for this now and it is kinda broscience but it gets the job done. This made me curious and I started reading on the topic. I saw a lot of possibilities to bypass a filter but none applies my scenario.

Here is the function I use to filter the users' input, I am well aware that it is not a good solution but I would like to know how to break it, if that's possible.

function encodeHTML(query) {
var chars = ["©","Û","®","ž","Ü","Ÿ","Ý","$","Þ","%","¡","¢","à","£","á","À","¤","â","Á","¥","ã","Â","¦","Ã","§","å","Ä","¨","æ","Å","©","ç","Æ","ª","è","Ç","«","é","È","¬","ê","É","­","ë","Ê","®","ì","Ë","¯","í","Ì","°","î","Í","±","ï","Î","²","ð","Ï","³","ñ","Ð","´","ò","Ñ","µ","ó","Õ","¶","ô","Ö","·","õ","Ø","¸","ö","Ù","¹","÷","Ú","º","ø","Û","»","ù","Ü","@","¼","ú","Ý","½","û","Þ","€","¾","ß","¿","ý","à","‚","À","þ","á","ƒ","Á","ÿ","å","„","Â","æ","…","Ã","ç","†","Ä","è","‡","Å","é","ˆ","Æ","ê","‰","Ç","ë","Š","È","ì","‹","É","í","Œ","Ê","î","Ë","ï","Ž","Ì","ð","Í","ñ","Î","ò","‘","Ï","ó","’","Ð","ô","“","Ñ","õ","”","Ò","•","Ó","ø","–","Ô","ù","—","Õ","ú","˜","Ö","û","™","×","ý","š","Ø","þ","›","Ù","ÿ","œ","Ú", "(", ")", ";","<",">","'", "/", ":", "!", "?", "-", "&", "{", "}", "\"", "="]; 
for(x=0; x<chars.length; x++){

    for(i=0; i < query.length; i++) {
        query = query.replace(chars[x], "");
    }
}
return query; }

This results in the result page not having any special characters, making the users' input worthless for possible XSS or at least I'd like to think that. I tried around already but everything needs special characters. Am I missing something obvious? Are there any things I should "verify" to make sure that this solution is "proof"?

marked as duplicate by Anders, Xander, SilverlightFox, techraf, Stephane Oct 13 '16 at 8:07

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 1
    Not security related, but the inner loop (for(i=0; ...) is pointless. You just need to run replace() once - it takes care of iterating over the characters of query. – Anders Oct 12 '16 at 13:45
  • 1
    The filter you use is not exactly the same as the one in the proposed duplicate, but the main point of the answer is the same: It is about context. In some context (most prominently between HTML tags) your filter is OK. In others it is not. There is no universal XSS filter for all contexts, so there is no point in trying to build one. – Anders Oct 12 '16 at 13:49
  • Whether it is breakable depends in part on what happens to the string after this encoding - you certainly are not filtering out, for instance, Unicode control characters that may be parsed or replaced. Since you are being so restrictive anyways, consider flipping to a whitelist based filter, rather than a blacklist. Ie, rather than listing bad characters that will be replaced, list good characters that will not be. – crovers Oct 12 '16 at 13:50
  • @crovers Alright, I will restructure my filter then. What do you mean regarding unicode control characters? Don't I need "&" and ";" to escape such character in HTML anyways? Or is there a way without special characters? – youngStupidQuestionGod Oct 12 '16 at 13:56
  • There's no guarantee you won't be fed UTF-8 strings that contain unicode control characters in the raw - some parsers, potentially including whatever eats this string after, may interpret those. – crovers Oct 12 '16 at 14:06

Browse other questions tagged or ask your own question.