I'm going through a vulnerability remediation exercise for a client and am trying to figure out how to best mitigate this particular hole. There's a script on our site that calls up content into a new window using <%= %>
. Essentially this takes a hard-coded link in an include file looking something like
<a href="/path/to/script?x=/path/to/linked/thing.img" target="">link</a>
and displays it on the resulting page within html using a script looking something like:
<img src="<% =request.querystring("x") %>">
This script is in hundreds of includes, so I'm trying to figure out the most efficient way of mitigating it. Should I use a find and replace to remove the script from the include files or is there a way to sanitize the actual script using something other than <%= %>
?
The whole thing is legacy, super clunky and needs to be replaced anyway, but like I said, we're talking about hundreds of files here, and not all follow the same syntax so I can't run a batch find and replace for all of them. It'll have to be in small batches and I'll still have to go into each one to check if something broke. Kill me now.
I'm a designer/front-end dev, not a security expert (and not a JavaScript whiz either), so any help here would be much appreciated.