XSS Attacks - Revision history

Christina Schelin: Tiny feex.

2016-06-15T14:39:04Z

Tiny feex.

MediaWiki spam cleanup: Reverting to last version not containing links to s1.shard.jp

2009-06-03T12:50:12Z

Reverting to last version not containing links to s1.shard.jp

Deleted user at 02:12, 31 May 2009

2009-05-31T02:12:58Z

MediaWiki spam cleanup: Reverting to last version not containing links to s1.shard.jp

2009-05-29T18:00:42Z

Reverting to last version not containing links to s1.shard.jp

Deleted user at 16:31, 29 May 2009

2009-05-29T16:31:42Z

MediaWiki spam cleanup: Reverting to last version not containing links to www.textbasdelli.com

2009-05-27T18:29:04Z

Reverting to last version not containing links to www.textbasdelli.com

MediaWiki spam cleanup: Reverting to last version not containing links to s1.shard.jp

2009-05-27T15:59:54Z

Reverting to last version not containing links to s1.shard.jp

Deleted user at 12:04, 26 May 2009

2009-05-26T12:04:45Z

Deleted user at 15:52, 22 May 2009

2009-05-22T15:52:42Z

KirstenS at 00:08, 8 April 2009

2009-04-08T00:08:11Z

@@ Line 2: / Line 2: @@
 Contact author: [mailto:eoinkeary@owasp.org Eoin Keary]
-----
+:'''NOTICE: PLEASE SEE [[Reviewing code for XSS issues]] as this page may not be up to date.'''
-----
+==XSS attacks ==
 Bad code example:
 If the text inputted by the user is reflected back and has not been data validated the browser shall interpret the inputted script as part of the mark up and execute the code accordingly.
 To mitigate this type of vulnerability we need to perform a number of security tasks in our code:
@@ Line 58: / Line 53: @@
+  }
-Focusing on XSS we can see that this action class returns either a message, ActionMessage  in the case of the function being successful.
+The red text above shows some common mistakes in the development of this struts action class. Firstly the data passed in the HttpServletRequest is placed into a parameter without being data validated.
 In the case of an error the code in the Try/Catch block is executed and we can see here that the data inputted by the user, the data contained in the HttpServletRequest is returned to the user, unvalidated and exactly in the format in which the user inputted it.
   import java.io.*;

@@ Line 1: / Line 1: @@
 [[OWASP Code Review Guide Table of Contents]]
@@ Line 91: / Line 51: @@
+  {
   ActionErrors errors = new ActionErrors();
-  ActionError error = new ActionError("error.employee.databaseException" + âPayload: â+payload);
+  ActionError error = new ActionError("error.employee.databaseException" + “Payload: “+payload);
   errors.add( ActionErrors.GLOBAL_ERROR, error );
   saveErrors( request, errors ); return (mapping.findForward("error: "+ searchQuery));
@@ Line 114: / Line 74: @@
+  {
-  String input = req.getHeader(âUSERINPUTâ);
+  String input = req.getHeader(“USERINPUT”);
   PrintWriter out = res.getWriter();
@@ Line 146: / Line 106: @@
   Sub cmdSearch _Click(Source As Object, _ e As EventArgs)
-  // Do Searchâ¦..
+  // Do Search…..
-  	// â¦â¦â¦â¦
+  	// …………
   lblResult.Text="You Searched for: " & txtInput.Text
-  // Display Search Resultsâ¦..
+  // Display Search Results…..
-  // â¦â¦â¦â¦
+  // …………
   End Sub
@@ Line 220: / Line 180: @@
 The approach to mitigate against this si to ensure the data sent to the browser is not going to be interpreted by the browser as mark-up and should be treated as user data.
-We encode known bad to mitigate against this âenemy withinâ. This in effect assures the browser interprets any special characters as data and markup.
+We encode known bad to mitigate against this “enemy within”. This in effect assures the browser interprets any special characters as data and markup.
 How is this done?
 HTML encoding usually means '''&lt;''' becomes '''&amp;lt;''', '''&gt;''' becomes '''&amp;gt;''', '''&amp;''' becomes '''&amp;amp;''', and '''&quot;''' becomes '''&amp;quot;'''.

@@ Line 1: / Line 1: @@
 [[OWASP Code Review Guide Table of Contents]]
@@ Line 51: / Line 91: @@
+  {
   ActionErrors errors = new ActionErrors();
-  ActionError error = new ActionError("error.employee.databaseException" + “Payload: “+payload);
+  ActionError error = new ActionError("error.employee.databaseException" + âPayload: â+payload);
   errors.add( ActionErrors.GLOBAL_ERROR, error );
   saveErrors( request, errors ); return (mapping.findForward("error: "+ searchQuery));
@@ Line 74: / Line 114: @@
+  {
-  String input = req.getHeader(“USERINPUT”);
+  String input = req.getHeader(âUSERINPUTâ);
   PrintWriter out = res.getWriter();
@@ Line 106: / Line 146: @@
   Sub cmdSearch _Click(Source As Object, _ e As EventArgs)
-  // Do Search…..
+  // Do Searchâ¦..
-  	// …………
+  	// â¦â¦â¦â¦
   lblResult.Text="You Searched for: " & txtInput.Text
-  // Display Search Results…..
+  // Display Search Resultsâ¦..
-  // …………
+  // â¦â¦â¦â¦
   End Sub
@@ Line 180: / Line 220: @@
 The approach to mitigate against this si to ensure the data sent to the browser is not going to be interpreted by the browser as mark-up and should be treated as user data.
-We encode known bad to mitigate against this “enemy within”. This in effect assures the browser interprets any special characters as data and markup.
+We encode known bad to mitigate against this âenemy withinâ. This in effect assures the browser interprets any special characters as data and markup.
 How is this done?
 HTML encoding usually means '''&lt;''' becomes '''&amp;lt;''', '''&gt;''' becomes '''&amp;gt;''', '''&amp;''' becomes '''&amp;amp;''', and '''&quot;''' becomes '''&amp;quot;'''.

@@ Line 1: / Line 1: @@
 [[OWASP Code Review Guide Table of Contents]]
@@ Line 52: / Line 51: @@
+  {
   ActionErrors errors = new ActionErrors();
-  ActionError error = new ActionError("error.employee.databaseException" + âPayload: â+payload);
+  ActionError error = new ActionError("error.employee.databaseException" + “Payload: “+payload);
   errors.add( ActionErrors.GLOBAL_ERROR, error );
   saveErrors( request, errors ); return (mapping.findForward("error: "+ searchQuery));
@@ Line 75: / Line 74: @@
+  {
-  String input = req.getHeader(âUSERINPUTâ);
+  String input = req.getHeader(“USERINPUT”);
   PrintWriter out = res.getWriter();
@@ Line 107: / Line 106: @@
   Sub cmdSearch _Click(Source As Object, _ e As EventArgs)
-  // Do Searchâ¦..
+  // Do Search…..
-  	// â¦â¦â¦â¦
+  	// …………
   lblResult.Text="You Searched for: " & txtInput.Text
-  // Display Search Resultsâ¦..
+  // Display Search Results…..
-  // â¦â¦â¦â¦
+  // …………
   End Sub
@@ Line 181: / Line 180: @@
 The approach to mitigate against this si to ensure the data sent to the browser is not going to be interpreted by the browser as mark-up and should be treated as user data.
-We encode known bad to mitigate against this âenemy withinâ. This in effect assures the browser interprets any special characters as data and markup.
+We encode known bad to mitigate against this “enemy within”. This in effect assures the browser interprets any special characters as data and markup.
 How is this done?
 HTML encoding usually means '''&lt;''' becomes '''&amp;lt;''', '''&gt;''' becomes '''&amp;gt;''', '''&amp;''' becomes '''&amp;amp;''', and '''&quot;''' becomes '''&amp;quot;'''.

@@ Line 1: / Line 1: @@
 [[OWASP Code Review Guide Table of Contents]]
@@ Line 51: / Line 52: @@
+  {
   ActionErrors errors = new ActionErrors();
-  ActionError error = new ActionError("error.employee.databaseException" + “Payload: “+payload);
+  ActionError error = new ActionError("error.employee.databaseException" + âPayload: â+payload);
   errors.add( ActionErrors.GLOBAL_ERROR, error );
   saveErrors( request, errors ); return (mapping.findForward("error: "+ searchQuery));
@@ Line 74: / Line 75: @@
+  {
-  String input = req.getHeader(“USERINPUT”);
+  String input = req.getHeader(âUSERINPUTâ);
   PrintWriter out = res.getWriter();
@@ Line 106: / Line 107: @@
   Sub cmdSearch _Click(Source As Object, _ e As EventArgs)
-  // Do Search…..
+  // Do Searchâ¦..
-  	// …………
+  	// â¦â¦â¦â¦
   lblResult.Text="You Searched for: " & txtInput.Text
-  // Display Search Results…..
+  // Display Search Resultsâ¦..
-  // …………
+  // â¦â¦â¦â¦
   End Sub
@@ Line 180: / Line 181: @@
 The approach to mitigate against this si to ensure the data sent to the browser is not going to be interpreted by the browser as mark-up and should be treated as user data.
-We encode known bad to mitigate against this “enemy within”. This in effect assures the browser interprets any special characters as data and markup.
+We encode known bad to mitigate against this âenemy withinâ. This in effect assures the browser interprets any special characters as data and markup.
 How is this done?
 HTML encoding usually means '''&lt;''' becomes '''&amp;lt;''', '''&gt;''' becomes '''&amp;gt;''', '''&amp;''' becomes '''&amp;amp;''', and '''&quot;''' becomes '''&amp;quot;'''.

← Older revision		Revision as of 00:08, 8 April 2009
Line 202:		Line 202:
	So for example the text <script> would be displayed as <script> but on viewing the markup it would be represented by &lt;script&gt;		So for example the text <script> would be displayed as <script> but on viewing the markup it would be represented by &lt;script&gt;

−	~~[[Alternate XSS Syntax]]~~

	[[Category:OWASP Code Review Project]]		[[Category:OWASP Code Review Project]]