0

On a client's corporate network something is stripping all <script> elements that contain code, i.e. things like <script type="text/javascript">do_something();</script> will simply be stripped from server response before it reaches the browser. SSL doesn't help (and of course, the certificate appears broken even though it's perfectly valid).

On the other hand, HTML elements like <script src="/something.js"></script> aren't getting stripped and run in the browser just fine.

My question:

Is there any security benefit from such stripping?

I certainly can't see one... XSS comes to mind, but if someone is going to do a XSS attack, they'll probably try the variant with src, no?


And a side-question: what software could they be using? Or better yet, what can I use to emulate that situation on my Mac or PC where the development happens?

  • 2
    Any attack that can be done with <script type="text/javascript">do_something();</script> can also be done with <script src="/something.js"></script> so this is like blocking access to one door while leaving the door on the other side still accessible. All I can think of is that they are trying to block a specific thing that is formed a specific way without considering the other forms it could take. – jfriend00 Mar 20 '15 at 17:20
9

No, stripping <script> tags is useless because you could still execute a javascript payload like this:

<input onmouseover=prompt(document.cookie)>

And bypassing the filter should also be quite easy, imagine what would happen if a payload like this sent:

<scr<script>ipt> 

As far as what type of software they are using, well there's just not enough information to determine that. What you could do is request the robots.txt and see what this discloses.

In order to simulate / test this, you could use the following code as an example:

<?php

if (isset($_GET['q']))
{
   $var = $_GET['q'];
   $var = str_replace(array("<script>", "<script src"), "", $var);

   echo $var;
} 
else 
{
   echo "GET parameter 'q' is not set!";
   die();  
}

?>

The solution to this problem is input validation and output encoding. Here's an OWASP resource that I recommend reading: https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet

  • Thanks for a good answer. I might have been vague with the part of the question about simulating this. I need it to be simulated before it reaches my Apache server, not afterwards (also, it's a Python/WSGI app, not PHP). – frnhr Mar 25 '15 at 11:50
  • The PHP code was used just an example. If a payload is executed before it reaches the web server, you might want to look in to DOM based XSS attacks: owasp.org/index.php/DOM_Based_XSS – Jeroen Mar 28 '15 at 8:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.