How to stop JS from executing when passed in as a parameter to the URL? (no script tags)

Question

I needed to stop an XSS attack from happening when the payload is inserted into the URL as a parameter. In this case though, there are no script tags. This is my URL which causes an XSS attack:

localhost/example/file.jsp?testParm1=');alert(1);('&testParm2=');alert(1);('

When I hit enter after typing this into my browser, an alert dialog saying "1" popped up. When I clicked "OK" on that, the alert dialog saying "2" came up.

I am using JSP's, so in file.jsp, I grab those parameters I passed in:

<%
   // Get url parameters
   String lTestParm1 = myObj.retrieveString( "testParm1" );
   String lTestParm2 = myObj.retrieveString( "testParm2" );
%>

Usually for XSS prevention I would escape the special characters so it wouldn't run whatever is in the parameter as javascript (for example if I put testParm1=<script>alert('hey')</script> into the URL), but I can't do that since there are no script tags.

Now in the JS portion of the code also in file.jsp:

<script language="JavaScript" type="text/javascript">

    var lWindow = popUp( '<%= lTestParm1 %>');    // I think it is happening here

    <custom_tag:If condition="<%= lTestParm2 == null %>">
        // Do something
    </custom_tag:If>
    <custom_tag:Else>
        window.location.replace( '<%= lTestParm2 %>' );    // And possibly here
    </custom_tag:Else>

</script>

I put a couple comments beside the 2 lines where I think the problem is.

To try and stop this XSS attack, I replaced each apostrophe with 2 apostrophe's in the URL. This seemed to work for this case.

I couldn't find any other articles/questions relating to this problem, but I did find similarities with SQL injection apostrophe replacement questions. They said that there are still many ways to get past apostrophe replacement by itself.

Here's a link to one of the questions: https://stackoverflow.com/questions/15537368/how-can-sanitation-that-escapes-single-quotes-be-defeated-by-sql-injection-in-sq

This made me wonder if my solution is sufficient enough, or if there are still ways to perform an XSS attack even with my apostrophe replacement in place.

Answer 1

One good way of dealing with this would be to replace all special characters (specifically the following 6 #/'();) with their HTML character entity equivalents. It will visually appear the same but javascript will not recognise it as that character.

The main examples.

• # becomes #
• / becomes /
• ' becomes '
• ( becomes (
• ) becomes )
• ; becomes ;

You can see more HTML references here: https://dev.w3.org/html5/html-author/charref

edit1: Also, filter out the URL encoded versions as these will be converted to the ASCII equivilant on hitting the server but perhaps after you replace them. it depends on when you validate. You should also limit the length of the input, as this can make XSS less effective if you accidentally let something through. If avoidable, don't reflect inputs into javascript.

edit2: You could even get a library to encode the entire string into the HTML character entity equivalents. Probably the easiest.