7

I'm not aware of all the xss tricks..

While programming in Ruby on Rails, using a sanitize method to allow only certain tags and it makes its best to clear all the other tags and scripts

the remaining tags are

    "small", "dfn", "sup", "sub", "pre", "blockquote", "ins", "ul", "var", "samp", "del",
 "h6", "h5", "h4", "h3", "h2", "h1", "span", "br", "hr", "em", "address", "img", "kbd",
 "tt", "a", "acronym", "abbr", "code", "p", "i", "b", "strong", "dd", "dt", "dl", "ol",
 "li", "div", "big", "cite"

Is it possible to create an XSS attack with a combination of these tags?

Improve this question
0

4 Answers 4

Reset to default
16

Yes. It's trivial.

<div onmouseover="alert(1)" style="position:fixed;left:0;top:0;width:9999px;height:9999px;"></div>

Might want to save your work before trying that, though - the alert might show repeatedly as you move your mouse across the screen.

Of course, a better attack would involve destroying the div as soon as the JavaScript is called, in order to make it look legitimate.

You should escape all output in order to avoid this.

Improve this answer
7
  • is it possible if " is escaped?
    – Nick Ginanto
    Dec 3, 2012 at 16:21
  • 1
    Yes, they can just use ' instead. Or they could exploit unicode parsing tricks to inject a " or ' character.
    – Polynomial
    Dec 3, 2012 at 16:22
  • 1
    @Nick Ginanto yes onmouseover=alert(1)
    – rook
    Dec 3, 2012 at 16:25
  • Ah, yes, they could just do that instead, too.
    – Polynomial
    Dec 3, 2012 at 16:26
  • onmouseover requires user interaction, onerror fires on pageload.
    – Jacco
    Jan 10, 2013 at 10:46
14

Yes, almost all HTML tags allow you to declare an event handler. Some of these events could be triggered when the page loads without user interaction:

<img src=x onerror=alert(1) />

Event tags are not the only way to trigger xss:

<a href=javascript:alert(1)>xss</a>

One possilbe solution is to set the Content Security Policy for this page

X-Content-Security-Policy: unsafe-inline

Just make sure to actually test your solution. Don't take anyone's word. (Also the CSP is new)

Another option is PHP's HTMLPurifer which is more advanced than Ruby's Sanitize.

Improve this answer
2
  • is there a comparison for htmlpurifier vs ruby sanitize? how do you know it is more advanced?
    – Nick Ginanto
    Dec 3, 2012 at 16:54
  • @Nick Ginanto nope, and read the docs they are very different.
    – rook
    Dec 3, 2012 at 16:55
2

Yes: <img onerror=alert(document.cookie) src=1 />

The requirements for output escaping vary based on location in the document. Text that is meant to be in an HTML attribute must be escaped differently ('") than text intended to be in an HTML element (<>), for example. The OWASP Enterprise Security API (ESAPI) is a good way to handle this, since it provides escaping mechanisms for all the different contexts. The Ruby version can be found on Github.

Improve this answer
2

For a good 'cheat sheet' containing a number of HTML XSS attacks, see here: OWASP.org They get quite creative. It is worth using that sheet to test your site as it's constructed and to check back from time to time as that list is updated.

Hope it helps!

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .