2

I've got a function in my app where users can click on a "thumbs up" image and a like is recorded in the database; all that's recorded is the user's ID and the ID of the post that the user liked.

I know user input can't be trusted--am sanitizing user inputs, validating user inputs (server-side), escaping outputs, and escaping db queries.

In this case, the user is clicking the image, but there is no form. However, data is being passed to the database, using JS. Note, there is no user input between any script tags (the like script is on a page that isn't served).

My plan is to validate (server-side) that only numbers are being sent to the database, but how do I sanitize this "like"/thumbs up input to protect against XSS?

Note: I'm currently reading through OWASP's XSS Prevention Cheat Sheet and Mozilla's Secure Coding Guidelines, which is how I started wondering about this.

  • I read your question is preventing attacks rather than sanitizing (because you mentioned XSS). So i answered that. If you want to literally know what values to post its 1/0/-1 for likes/unlike/dislike + the id of the item + the cookie/httponlycookie mentioned in my answer – user5575 May 20 '12 at 4:07
5

Sanitation is trivial, as this variable can only be two values. You could make it an intiger, and have a value of 1 for an up-vote and a value of -1 for a down vote, no other value is valid. Of course all security based validation must always be done server side.

But that is the least of your security concerns. The real concern is forcing other to vote on an attacker's behalf. This can happen a number of ways. An attacker could make a clickjacking game where by each time the user clicks to fire a rocket at some kind of space invader they are in fact clicking on an invisible iframe which is firing a new vote at your system.

An even more virulent attack would be to use Cross-Site Request Forgery (CSRF) to fire off these requests en-mass when one of your users visits an attackers website. The CSRF Prevention Cheat Sheet is a good resource.

Almost all Anti-CSRF measures are defeated by XSS, so make sure your entire website is immune to this attack. The Sammy Worm used XSS to defeat MySpace's Anti-CSRF token.

Also, don't forget about automatic account creation, make sure your users have to solve a strong captcha like Recaptcha before they can make an account. Email verification is trivial to automate and I don't believe its a real security measure. If they have too many failed logins they should also be prompted with a Capthca.

  • thank you for this answer. Accepted and upvoted. This is exactly what I was looking for. I hadn't heard about this clickjacking stuff, but will check it out, along with the CSRF cheat sheet (had it bookmarked). Codeigniter has built-in CSRF protection which I'm using, but I'm also reading about it and reviewing the code to learn as much as possible. Appreciate the rest of your advice also. – chowwy May 18 '12 at 2:15
  • 2
    +1 for the clickjacking, something new for me. – Lachezar Balev May 18 '12 at 6:39
0

Perhaps I'm misunderstanding your scenario, but the way I imagine it the sanitization should be fairly easy.

When a user thumbs up/thumbs down a post, there really only should be 2 values that are allowed as inputs - the up value, or the down value. For simplicity sake, I would just use 1 as Up, and 0 as Down. Then for your sanitation you just need to check that the value is either 1 or 0 (or, if you're more lax, that it is numerical).

In JS, simply do something like:

if(value !== 1 && value !== 0) {
    return false;
}

However, using JS as your only line of defense against XSS is a very bad idea. If someone wanted to send you bad data, they could simply use cURL to send you data while bypassing your javascript validation. I strongly suggest doing your validation server-side, and just use JS validation as a method to reduce the number of useless AJAX calls.

  • Appreciate your response; my question is around sanitizing non-form inputs in a JS function--I'm not using PHP for this function, and have already sanitized inputs for those. – chowwy May 18 '12 at 0:36
  • I noticed your edit; appreciate it, but I don't need help with the JS function, it's already working. – chowwy May 18 '12 at 0:41
  • 1
    Updated code to JS. But, please keep in mind the security warning. Validation in JS is not a safe alternative to server-side validation – jwegner May 18 '12 at 0:41
  • My question specifically says that I am using server-side validation! – chowwy May 18 '12 at 0:42
  • My apologies - I thought you meant server-side just for the form-based values. You should be good then :) – jwegner May 18 '12 at 0:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.