How to bypass htmlentities() function in PHP to get an XSS?

Question

Here is the PHP filter function that I'm dealing with:

function xss_check_2($data)
  {
    return htmlentities($data, ENT_QUOTES);
  }

The source code of the output (the output is the name, Peter Wazinck, at the bottom):

<div id="main">

<h1>HTML Injection - Reflected (GET)</h1>

<p>Enter your first and last name:</p>

<form action="/work/bwapp/bWAPP/htmli_get.php" method="GET">

    <p><label for="firstname">First name:</label><br>
    <input id="firstname" name="firstname" type="text"></p>

    <p><label for="lastname">Last name:</label><br>
    <input id="lastname" name="lastname" type="text"></p>

    <button type="submit" name="form" value="submit">Go</button>  

</form>

<br>
Welcome Steve Wozniak
</div>

Any method to bypass it?

Answer 1

From the context you provided, this filter appears safe.

Your output is in the data state (outside of any tags or attribute values). Therefore an attacker would need to inject at least an opening angle bracket (<) to introduce new HTML code.

Since htmlentities() converts all opening angle brackets to their HTML entity representation (<), there is no obvious way to bypass the filter.

Answer 2

In the bWAPP application there are 2 sets (3 sets really) of XSS protections. Level 2 and Level 3.

function xss_check_2($data)
{

    // htmlentities - converts all applicable characters to HTML entities

    return htmlentities($data, ENT_QUOTES);


}


function xss_check_3($data, $encoding = "UTF-8")
{
    // htmlspecialchars - converts special characters to HTML entities    
    // '&' (ampersand) becomes '&' 
    // '"' (double quote) becomes '"' when ENT_NOQUOTES is not set
    // "'" (single quote) becomes ''' (or ') only when ENT_QUOTES is set
    // '<' (less than) becomes '&lt;'
    // '>' (greater than) becomes '&gt;'  

    return htmlspecialchars($data, ENT_QUOTES, $encoding);

}

If you look at the level 3 filters they are setting the $encoding to UTF-8 which invalidates UTF-7 and other types of encodings. You may want to search the other encodings in Level 2 to see if you can find a filter bypass that works for you.