Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I use a PHP script which performs a database search and when no result are found, user is presented with a mailto link with this format
mailto:[email protected]?subject=SEARCHED_QUERY_HERE
The SEARCHED_QUERY_HERE is replaced with the search team that user searched which returned no result, Can anyone exploit it? (i encode SEARCHED_QUERY_HERE)
This could conceivably be abused for HTML injection. Imagine if a user searched for the term
waterfall</a><a href="http://maliciouslink.com">Click Here
The </a> in the search term would terminate the mailto link, and then insert a second link with the words "Click Here".
URL encoding will of course mitigate this problem.
Also, make sure you validate the search query before the database query, as well - otherwise, it could be abused in a similar fashion for SQL injection.
You need to URL-encode SEARCHED_QUERY_HERE, otherwise if a user searches for &body=something, the body of the e-mail message will be set to something. Also, if you don't URL-encode it, if the user searches for a literal %20 (or similar) it will appear as a space in the message instead.
This is not a security risk, though.
The other, obvious risk is that if you don't properly HTML-encode the SEARCHED_QUERY_HERE, it will lead to XSS. But it appears you're already doing so, so you're covered.
Some programming languages, such as PHP, require you to explicitly specify that quotes must be encoded as well, so make sure you pass the correct arguments to your HTML-encoding function.
echo '<a href="mailto:[email protected]?subject='.htmlspecialchars(rawurlencode(SEARCHED_QUERY_HERE), ENT_QUOTES, 'utf-8') .'>Link</a>';
I don't think so, but the greater concern is that you're allowing user input to modify the returned page. Make sure you're using a good API for validating user input (as it is used to generate the query) and that you are properly protecting the output in this page. Use OWASP's ESAPI if possible.
