0

I was reading the basics of XSS prevention on owasp xss rules. But the issue is rather abstract. The term "untrusted data" is often used. Every rule reminds not to insert untrasted data in the certain places in the page content like:

HTML comments

scripts

attribute names

tag names and so on...

But what is untrusted data? E.g. i'm sending data (user name) from the serverside that has been extracted from database. Is this data going to be trusted data?

E.g. the user submits the form and sends the text input value or the client makes any request (with parameters or not). Is this data going to be untrusted one?

  • 1
    if you make it, its trusted. if a user submits it and you clean it up, it's trusted. If it comes from a trustworthy place, like an API, it's trusted. If none of the above apply, it's untrusted. – dandavis Oct 8 '17 at 20:38
  • 2
    @dandavis Nice summary, although, to be pedantic, a trusted API might still serve unsanitized user content. – Arminius Oct 8 '17 at 21:46
  • @Arminius: I suppose that depends on the API. We (webdevs) tend to trust them completely (naively?). I've not heard of an attack through a mainstream API (other than ads), which is surprising... – dandavis Oct 10 '17 at 2:00
  • In general API is not considered to be a dangerous gate. For example I'm working now with Steam API and there is no way to panic. But I guess that the received data is still untrusted because it was delivered outside. – Max Bender Oct 10 '17 at 19:07
4

Anything the user inputs (or can control the value of) is untrusted. Always filter and validate.

Anything dynamically generated that may consume user controllable data is untrusted. Always sanitise.

Basically anything is deemed untrusted if you are not 100% in control of it.

i'm sending data (user name) from the serverside that has been extracted from database. Is this data going to be trusted data?

No, apply the rules above and you will see if the original username was not properly validated and/or the output is not sanitised the user name, could be <scrip>alert('xss')</script> basically a stored xss value or any other value the user or bad actor wants.

2

Untrusted data is data that has come in across a trust boundary - in web applications that most often means data that the user was in control of (data that came from the client). But this also can be data that originally came from an untrusted source (such as user name) that you may have stored, or data coming from another system - it still is untrusted. Data can be sanitized via whitelist validation, the safest way is to validate against a fixed list of values. You can validate a whitelist of characters but you need to be very restrictive since you often don't know where the data is going to be used - different characters can be used for HTML, javascript, SQL, OS, REST injections.

Its generally simplest and safest to treat all data as untrusted, and properly validate and encode it for the correct output.

0

"untrusted data" means different things in different contexts.

In the context of the owasp rules it refers to passing data directly from input to output without ensuring that the representation of the data is appropriate for the output channel.

In the context you provided, the data may previously have been in a safe form to send to the database, but that does not mean that it is in a safe form to send to a browser? To a pdf file? To write back into a database?

While in most cases it is sufficient to know that the data is encoded in such a way that it cannot have side-effects on the output medium, in many cases "trust" is often dependent on the information in the data - not just its representation. Its easy to create certificates, account numbers, dosages....but trust is about ensuring the accuracy and accountability for the information is retained.

  • The third case brings understanding how trusted data is also about information in the data. It may seem that this part may be ignored because of its obviousness at first. But it helps while building an application architecture and data flows. – Max Bender Oct 29 '17 at 21:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.