2

What is the right way to escape bad data the var "$actuallinkk" inside this java script

<a href="javascript:reportUser(\''.$actuallinkk.'&act=inviteadmin\')">Invite Consultant to this conversation</a>

this is what i did below, i don't know if is the right thing to tackle xss attack.

function noHTML($input, $encoding = 'UTF-8')
{
    return htmlentities($input, ENT_QUOTES | ENT_HTML5, $encoding);
}




$actuallinkk = "http://$_SERVER[HTTP_HOST]$_SERVER[REQUEST_URI]";

 echo'<script>
function reportUser(repUrl) {
  if (confirm("Are you sure you want to invite Consultant to this chat?")) {
   document.location = repUrl;
  }
}
</script>

';
echo'
<li><a href="javascript:reportUser(\''.noHTML($actuallinkk).'&act=inviteadmin\')">Invite Consultant to this conversation</a>
</li><br/>';


if($_GET["act"]=='inviteadmin'){}

this is the output of the code

  • How does reportUser() work? How are you decoding the content? – lorenzog Feb 2 '17 at 22:05
  • it just a prompt link that allow users to confirm request 'continue action or no' before getting action – General Omosco Feb 2 '17 at 23:47
  • i just want to be safe in this area '.$actuallinkk.' because user can add xss code to the main url in their url bar, then the actuallinkk will take both the link and the xss as current page link and add it inside the href attribute – General Omosco Feb 2 '17 at 23:57
  • i just want to escape bad data from the link – General Omosco Feb 3 '17 at 0:00
  • Ok, but what I meant was: once you encode HTML characters with htmlentities, you'll have to decode them at some point to use them. I suppose reportUser() will do something like html_entity_decode(). Depending on how you decode it and how you use it, that might be the vulnerable point. How about a whitelist instead? – lorenzog Feb 3 '17 at 8:46
1

No, this is not the correct approach, and you are currently vulnerable to XSS via this payload:

http://example.com/yourscript.php/');alert('1

Attack

As seen above, an attack would be setting $actuallinkk to:

1');alert('1

Which results in:

<a href="javascript:reportUser('1&apos;&rpar;&semi;alert&lpar;&apos;1&act=inviteadmin')">

Now, this looks save enough, but it isn't. As the input is inside a HTML attribute context, the HTML parser will look at it and dereference the entities. It will then pass the result on to the JavaScript interpreter, at which point the code looks like this:

reportUser('123');alert('1&act=inviteadmin')

This will be executed, including the injected payload.

Defense

The above example shows why it is important to take the context into account when defending against XSS.

Inside a JavaScript context, you do not want to HTML encode, but instead escape all special characters with their hex values (see OWASP).

  • This is what i wanted to do before but the splash [a-zA-Z0-9.?=&_:(/ this very one make it not to work)] inside make the prg_match not to work. How can i implement the splash $rawactuallink = "https://$_SERVER[HTTP_HOST]$_SERVER[REQUEST_URI]"; if (preg_match("/^[a-zA-Z0-9.?=&_:/]*$/", $rawactuallink)) { $actuallinkk = $rawactuallink; } else { $actuallinkk = ""; } – General Omosco Feb 3 '17 at 12:01
  • but i'm using the noHTML function in the webpage hope is good or not – General Omosco Feb 3 '17 at 15:22
0

This is what i finally did

 $rawactuallink = "https://$_SERVER[HTTP_HOST]$_SERVER[REQUEST_URI]";

if (preg_match("/^[a-zA-Z0-9.#?=&_:\/]*$/", $rawactuallink)) {
$actuallink = $rawactuallink;
}
else
{
$actuallink = "https://www..com/err";
}

Hope it make sense to use this

0

Do things step by step:

You build your link on PHP, so you do $actuallinkk .'&act=inviteadmin'

You then put this link in a javascript context, so you json_encode it with 'javascript:reportUser(' . json_encode($actuallinkk .'&act=inviteadmin') . ')'

You then put this Javascript String in an HTML context, so you htmlentities it with <a href="<?php echo htmlentities('javascript:reportUser(' . json_encode($actuallinkk .'&act=inviteadmin') . ')', ENT_HTML, 'utf-8'); ?>">Invite Consultant to this conversation</a>

Last, you should not rely on GET to do something like "Inviting someone" (unless this link retrieves the page to do the invite). Doing the invite itself should be done by POST (so in a <form>).


Note that you shouldn't rely on REQUEST_URI as you did, since it may not contain any query string (like https://duckduckgo.com, it would result in a link like https://duckduckgo.com&act=inviteadmin which may even not resolve as the correct host). You probably know which page you're on, so use this directly (like /mypath/mypage.php?myparam=myvalue).

  • <a href="'.htmlentities('javascript:reportUser(' . json_encode($actuallinkk) .'&act=inviteadmin')', ENT_HTML, 'utf-8').'">Invite Consultant to this conversation</a> not working – General Omosco Feb 4 '17 at 10:15
  • That's because you haven't properly copy/pasted what I answered. Double check what's around &act=inviteadmin. Btw, "the Universe is not working" calls for more details. – Xenos Feb 4 '17 at 16:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.