5

In addition to scanning user uploaded files, I would also like to ensure that forms for user profiles, comments, etc. cannot be misused to submit malicious script. What are some known good methods of doing so? Should checking for script injection attacks be done client side or server side?

FWIW, I have checked a few security related modules in NPM, but they mostly seem to concern security of other modules, and its possible I have missed something useful.

One way I am aware of, is to strip out all HTML tags, but I think it is a bit heavy handed as well as probably not effective in all cases.

Update: As the question stood, it probably gave the impression of being about xss, despite the injection tag. So this is just to clear up that it is about both xss, as well as sql injection.

  • 2
    Client side = no security at all. – Deer Hunter Aug 17 '15 at 11:06
  • 4
    Please read OWASP. – Deer Hunter Aug 17 '15 at 11:07
  • Are you using a template engine to generate your html? – Justin Moore Aug 18 '15 at 21:35
  • At the moment, no, but it will be the case shortly. And as to which engine, that's not been completely decided yet (the security discussion comes first); mustache/handlebars are currently being considered. Any other suggestion is welcome too. – Yogesch Aug 19 '15 at 3:59
1

SQL

Protection against SQL injections is done using prepared statements. Generally speaking, it is best practice to avoid manual concatenation of user generated strings in SQL statements.

Instead use the ? annotation and provide the input string as a parameter. The driver makes sure to block any SQL injection attempts, as well as unexpected user input.

MySQL example -

PreparedStatement ps = connection.prepareStatement("INSERT INTO tbl VALUES (?)");
ps.setString(1, "'abc'); TRAUNCATE TABLE users; SELECT (1");
ps.executeUpdate();

The injection attempt will fail.

XSS

You can HTML escape user generated strings or just replace < with &gt; and > with &lt;, before sending it to the client or when writing it to the database.

Also, check out the Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet guide.

7

Stripping out HTML tags is not a sufficient approach to protecting yourself from XSS. Consider the following input:

<scri<script>pt>

If you strip out the <script> tag, another script tag is created. This is just one example - there are many other attacks that could be used.

You should look into protecting yourself from XSS on the server side - this way users do not have the ability to modify/bypass your client side code.

Protecting yourself against XSS is totally doable, but you should make sure you are using the correct approach. As usual OWASP's instructions on how to protect yourself is probably the best way to go.

  • Thank you. It (OWASP instructions) seems to deserve a very close and careful look indeed. If I understood correctly, the guidelines are mainly best practices to be followed while coding, and a couple of suggested packages. I was wondering if there was some tool to test existing code against those guidelines... – Yogesch Aug 17 '15 at 16:49
2

There are two main methods that are commonly discussed when dealing with user input. These two methods are validation and sanitisation.

Both of these should be most definitely done on the server side. Client side protections will not prevent attacks such as cross-site scripting or SQL injection.

In particular, I think you're talking about cross-site scripting attacks. It seems that this node module (https://github.com/theSmaw/Caja-HTML-Sanitizer) may be suitable for what you're trying to achieve.

Stripping out all HTML tags is not necessarily a great idea. This is because event based cross-site scripting may still be possible. For example:

<a href="/yourprofilename">yourprofilename</a>

If the user has the ability to change the yourprofilename section, consider the following input:

" onfocus="prompt(document.location); autofocus"

This would turn the link into this:

<a href="/" onfocus="prompt(document.location);" autofocus">yourprofilename</a>

This would trigger cross-site scripting without the use of HTML tags.

  • Many thanks! I had a look and will check out in detail the Caja HTML module. By the way, I was asking about for xss as well as injection (there was the injection tag). Would you mind throwing some light on that too? – Yogesch Aug 17 '15 at 16:44
-1

Try out the npm module strip-js. It removes all JavaScript code from some HTML text by doing the following:

  • Sanitizing HTML
  • Removing script tags
  • Removing attributes such as "onclick", "onerror", etc. which contain JavaScript code
  • Removing "href" attributes which contain JavaScript code

https://www.npmjs.com/package/strip-js

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.