4

This question already has an answer here:

In OWASP XSS cheat sheet it is written

In addition to the 5 characters significant in XML (&, <, >, ", '), the forward slash is included as it helps to end an HTML entity.

So the recommended escapings are

 & --> &amp;
 < --> &lt;
 > --> &gt;
 " --> &quot;
 ' --> &#x27;
 / --> &#x2F;

What if I skipped escapings of /? What are the examples of attacker payload using just / that can trigger XSS or other attack (assuming & < > " ' are all escaped)?

In my particular scenario, we have an XSS filter in the Java servlet, which sanitizes the payload of all incoming HTTP requests (it can be argued if it's a good solution or not), and it replaces / --> &#x2F; which is a pain because / is a valid character in street names etc. One option would be to redecode &#x2F --> / but I'm wondering if there are any merits of keeping / escaped?

Edit: why I don't want to have / to be escaped:

The / is escaped before data comes to the Java code which saves stuff to DB. So, Java asks the DB to save escaped data, then when the frontend app asks Java to give us back the data, it gives back a JSON like

{something: "a &#x2F b"}

instead of

{something: "a / b"}

(well, to fix that, we could just have Java code iterate over the structure it returns and unescape it, but maybe there's no point in escaping it in the first place?)

Note that the same backend is consumed by many frontends, some of them non-HTML. It doesn't make any sense to serve escaped HTML data as a JSON, particularly for non-HTML consumers (correct me if I'm wrong).

Moreover, in HTML app, we use Angular code like this

<p>Hello {{name}}!</p>

which, when given a &#x2F b, will print that string literally to the user (i.e. Angular does another round of escaping by replacing & to &amp; etc.).

To have HTML entities interpreted, I'd have to use ng-bind-html (see this plunk)

<p>Hello <span ng-bind-html="name"></span>!</p>

but I expect my JSON contents to be regular text, so I don't want to use ng-bind-html as it lowers the security.

marked as duplicate by drewbenn, Matthew, Stephane, Community Nov 30 '16 at 15:52

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • Is there a particular reason you want the "/" to be unescaped? The browser should render the HTML entity as the correct character upon retrieval. – John Nov 29 '16 at 18:34
  • 1
    1997 called, it wants magic_quotes_gpc back. – CodesInChaos Nov 29 '16 at 18:47
  • @John I updated my question – jakub.g Nov 29 '16 at 20:38
  • The additional information certainly helps. I would agree, if some of your frontends are non-HTML, you would probably have to do escaping in Java. However, I also agree with Arminius' answer below that forward slashes alone probably don't pose enough of a threat to justify the work, though it would seem to me that sanitization would probably be an all-or-nothing endeavor (ie - you may run into the same issues with other special chars that pose a more legitimate security threat). In my opinion, you should still escape the characters when in doubt since lack of sanitation does pose a risk. – John Nov 29 '16 at 21:23
1

Injecting a forward slash is not a common attack vector for XSS.

The required escaping depends on the context where you're printing the output. A forward slash is used to close a tag and there is no other HTML context where it's inherently dangerous. (In Javascript this would of course be a very different story. Also, slashes are relevant in other attacks, such as directory traversals.)

What are the examples of attacker payload using just / that can trigger XSS?

Such scenarios are rather artificial. For example, between a <title> tag all other tags are ineffective until you close the tag again. This would not trigger:

<title><img src=foo.jpg onerror=alert('no bounty for you')></title>

So if you encounter a scenario like...

<title>[userinput]</title>

...you would need a slash to be able to close the title tag yourself to achieve XSS.

The reason why the OWASP cheat sheet recommends a few more measures is to cover multiple output contexts at once. Since XSS escaping should only be employed on the final output, it doesn't hurt to escape a few more characters. (From your description it sounds like you are processing the data after XSS escaping which is not the idea.)

Example 1:

Welcome <span>[username]</span>!

Here, it would technically be sufficient to just escape < in the username since an attacker cannot inject new tags.

Example 2:

Your new name: <input type="text" value="[username]">

Here, it would be sufficient to escape " to avoid XSS because an attacker can never get beyond the attribute value.

Example 3:

Your website: <a href="[yourlink]">Click me</a>

Here, escaping " in yourlink would avoid breaking out of the attribute but you have to take additional measures to disallow XSS via pseudo links like javascript:foo(). So the standard escaping would be insufficient here.

Not the answer you're looking for? Browse other questions tagged or ask your own question.