4 ms·

It's not rocket science. Escaping HTML properly is a good start. Not just "Oh yeah we better disallow any <script> tags". I mean properly, escape every single c

by axod 16y ago

It's not rocket science. Escaping HTML properly is a good start. Not just "Oh yeah we better disallow any <script> tags". I mean properly, escape every single character so that there is absolutely no possible way that anything can be interpreted as anything but a literal character to be displayed. <noscript_within> sounds like a good solution if you have no idea how to properly escape html. If you want to be extra sure, just send the data as JSON and build it out in the DOM as createTextNode so you're sure it's actually text and nothing else. From Reddit: >> All you need is: <script><script>PAYLOAD >> Any HTML after the second non-closed script tag survives unescaped. >> YouTube escapes the first script tag and not the second. This isn't "XSS attacks are inevitable and so hard to defend against". This is "WTF are you thinking youtube? Did you get a 12 year old to code your comment parsing code?"

chime 16y ago
> It's not rocket science I know. But it isn't cakewalk either when you take Unicode/UTF etc. into consideration. Myspace, Twitter, Facebook, and now YouTube have been bitten by it, some multiple times. My point is, with so much social content being user-generated, there is absolutely no way to wall-off the user-content easily. You have to manually make sure every piece of user data is parsed and filtered, and most developers do that but it's not easy. Show me the code that allows users to enter basic HTML (<a>, <b>, <p>, <u>) while preventing the bad stuff (<script>, <body>). Now make this code allow <a> to have attributes like href, title but not onclick, onmouseout. Allow <p> to have style attributes for font-family but not width:expression(400 + "px") style because that's another way to run JS in IE. You'll quickly see how it gets difficult really quick. The solution for most sites (including reddit/HN) is to use Markdown. It's not a perfect solution but it works for sites where data entry is restricted to a few fields. YouTube is so large and has so many places where users can enter arbitrary data that it is not simple to ensure there are no bugs anywhere. Again, I don't understand how my solution (a) fails in preventing all XSS hacks that we've seen so far. Each hack worked because users could insert JS code into a form that was not properly filtered. What is harder? Making sure every single web form on the Internet has 0 sanitization bugs or adding a single meta-tag to top browsers that says "Hey, don't run any inline JS."
- jeff18 16y ago
  I may be naive, but how about this? a) Escape everything 100%. b) Look for <a> tags, grab their href attribute, escape it, and insert them as <a href='$1'>$2</a>. c) Do the same for <b>, <p>, etc. How would that be vulnerable to XSS? A small whitelist of HTML would be replaced safely, and any script tags and so on would be escaped and displayed as is.
  - joeyh 16y ago
    In your example above, $1 may contain javascript. The easy way is href="data:text/javascript", or even href="javascript:alert('foo')"", but there are probably a dozen other ways, including data:image/svg. There's no real way to "escape" url attributes (some browsers are known to run 'any: ex' as javascript); parsing the url seems to be the only approach that works.
    - axod 16y ago
      So only allow http:// http:// and https:// https:// in URLs?
      - deleted 16y ago
        [deleted]
- axod 16y ago
  >> "show me the code that allows users to enter basic HTML (<a>, <b>, <p>, <u>) while preventing the bad stuff (<script>, <body>)." 1. Disallow everything. Escape everything 100%. 2. Now selectively parse out the original and recreate what is explicitly allowed. Do not include anything from the input in the code portions of the output that hasn't been completely sanitized. This isn't a hard problem. It's like asking "Make a firewall that allows mysql through and ssh, but nothing else". The thing is, people make mistakes, and developers are often lazy. >> "Making sure every single web form on the Internet has 0 sanitization bugs or adding a single meta-tag to top browsers that says "Hey, don't run any inline JS." Asking the browser to do your security for you seems pretty lazy. If you can't manage to escape HTML properly, what other security issues are there likely to be that the browser can't help with? SQL injections?

by axod 16y ago

chime 16y ago

> It's not rocket science I know. But it isn't cakewalk either when you take Unicode/UTF etc. into consideration. Myspace, Twitter, Facebook, and now YouTube have been bitten by it, some multiple times. My point is, with so much social content being user-generated, there is absolutely no way to wall-off the user-content easily. You have to manually make sure every piece of user data is parsed and filtered, and most developers do that but it's not easy. Show me the code that allows users to enter basic HTML (<a>, <b>, <p>, <u>) while preventing the bad stuff (<script>, <body>). Now make this code allow <a> to have attributes like href, title but not onclick, onmouseout. Allow <p> to have style attributes for font-family but not width:expression(400 + "px") style because that's another way to run JS in IE. You'll quickly see how it gets difficult really quick. The solution for most sites (including reddit/HN) is to use Markdown. It's not a perfect solution but it works for sites where data entry is restricted to a few fields. YouTube is so large and has so many places where users can enter arbitrary data that it is not simple to ensure there are no bugs anywhere. Again, I don't understand how my solution (a) fails in preventing all XSS hacks that we've seen so far. Each hack worked because users could insert JS code into a form that was not properly filtered. What is harder? Making sure every single web form on the Internet has 0 sanitization bugs or adding a single meta-tag to top browsers that says "Hey, don't run any inline JS."

jeff18 16y ago
I may be naive, but how about this? a) Escape everything 100%. b) Look for <a> tags, grab their href attribute, escape it, and insert them as <a href='$1'>$2</a>. c) Do the same for <b>, <p>, etc. How would that be vulnerable to XSS? A small whitelist of HTML would be replaced safely, and any script tags and so on would be escaped and displayed as is.
- joeyh 16y ago
  In your example above, $1 may contain javascript. The easy way is href="data:text/javascript", or even href="javascript:alert('foo')"", but there are probably a dozen other ways, including data:image/svg. There's no real way to "escape" url attributes (some browsers are known to run 'any: ex' as javascript); parsing the url seems to be the only approach that works.
  - axod 16y ago
    So only allow http:// http:// and https:// https:// in URLs?
    - deleted 16y ago
      [deleted]
axod 16y ago
>> "show me the code that allows users to enter basic HTML (<a>, <b>, <p>, <u>) while preventing the bad stuff (<script>, <body>)." 1. Disallow everything. Escape everything 100%. 2. Now selectively parse out the original and recreate what is explicitly allowed. Do not include anything from the input in the code portions of the output that hasn't been completely sanitized. This isn't a hard problem. It's like asking "Make a firewall that allows mysql through and ssh, but nothing else". The thing is, people make mistakes, and developers are often lazy. >> "Making sure every single web form on the Internet has 0 sanitization bugs or adding a single meta-tag to top browsers that says "Hey, don't run any inline JS." Asking the browser to do your security for you seems pretty lazy. If you can't manage to escape HTML properly, what other security issues are there likely to be that the browser can't help with? SQL injections?