4 ms·

That’s neat. What’s the total volume per day? Are the passwords themselves being escaped in the final UI rendering? Otherwise you’d have an XSS for a password l

by koolba 3y ago

That’s neat. What’s the total volume per day? Are the passwords themselves being escaped in the final UI rendering? Otherwise you’d have an XSS for a password like “<script>/* code */<script>". EDIT: Unless it's happening on the server side where it's being saved, I don't think they're being escaped: col1.innerHTML = '<span class="fi fi-' + msg.cc + '" title="' + msg.cc + '"></span> ' + msg.src; col2.innerHTML = msg.proto; col3.innerHTML = '<code>' + msg.u + '</code>'; col4.innerHTML = '<code>' + msg.p + '</code>';

mike_d 3y ago
It is escaped server side. Anything long enough to be a useful payload is trimmed.
- koolba 3y ago
  How short we talking? Since there's multiple opportunities to inject code, it's possible to split out the payload across multiple fields: https://www.highseverity.com/2011/06/xss-in-confined-spaces.html https://www.highseverity.com/2011/06/xss-in-confined-spaces.... Ten characters per block is enough for: <script>/* */eval(/* */'....'+/* */'....'+/* */'....'+/* ... */)/* */</script> Best to escape everything at render time.
  - mike_d 3y ago
    Everything is escaped server side before it is sent to the client. Shoot me an email and I will let you play with it after the HN traffic dies down.
    - jamesnorden 3y ago
      [dead]
- mike_hock 3y ago
  As the other comment said, just write proper code instead of going "oh but it's escaped and size-limited." JS has sane APIs where no string is "dangerous," use them.
unlog 3y ago
Sorry, but this is not the way. It's like saying, "but I am escaping my inputs on sql with my function"... instead of doing the right thing. The equivalent code is really not that hard: const span = document.createElement('span') span.setAttribute('class', 'fi fi'+msg.cc) span.setAttribute('title', msg.cc) col1.appendChild(span) col1.appendChild(document.createTextNode(msg.src)) col2.textContent = msg.proto let code = document.createElement('code') code.textContent = msg.u col3.appendChild(code) code = code.cloneNode(true) code.textContent = msg.p col4.appendChild(code) or something in these lines.. you get the idea

by koolba 3y ago

mike_d 3y ago

It is escaped server side. Anything long enough to be a useful payload is trimmed.

koolba 3y ago
How short we talking? Since there's multiple opportunities to inject code, it's possible to split out the payload across multiple fields: https://www.highseverity.com/2011/06/xss-in-confined-spaces.html https://www.highseverity.com/2011/06/xss-in-confined-spaces.... Ten characters per block is enough for: <script>/* */eval(/* */'....'+/* */'....'+/* */'....'+/* ... */)/* */</script> Best to escape everything at render time.
- mike_d 3y ago
  Everything is escaped server side before it is sent to the client. Shoot me an email and I will let you play with it after the HN traffic dies down.
  - jamesnorden 3y ago
    [dead]
mike_hock 3y ago
As the other comment said, just write proper code instead of going "oh but it's escaped and size-limited." JS has sane APIs where no string is "dangerous," use them.

unlog 3y ago

Sorry, but this is not the way. It's like saying, "but I am escaping my inputs on sql with my function"... instead of doing the right thing. The equivalent code is really not that hard: const span = document.createElement('span') span.setAttribute('class', 'fi fi'+msg.cc) span.setAttribute('title', msg.cc) col1.appendChild(span) col1.appendChild(document.createTextNode(msg.src)) col2.textContent = msg.proto let code = document.createElement('code') code.textContent = msg.u col3.appendChild(code) code = code.cloneNode(true) code.textContent = msg.p col4.appendChild(code) or something in these lines.. you get the idea