Cross Site Scripting: Skal jeg være bekymret ?

Description

Cross-site scripting or HTML injection is possible. Malicious script may be injected into the browser which appeared to be genuine content from the original site. These scripts can be used to execute arbitrary code or steal customer sensitive information such as user password or cookies.

Very often this is in the form of a hyperlink with the injected script embeded in the query strings. However, XSS is possible via FORM POST data, cookies, user data sent from another user or shared data retrieved from database.

Currently this check does not verify XSS from cookie or database. They should be checked manually if the application retrieve database records from another user's input.

Solution

Do not trust client side input even if there is client side validation. Sanitize potentially danger characters in the server side. Very often filtering the <, >, " characters prevented injected script to be executed in most cases. However, sometimes other danger meta-characters such as ' , (, ), /, &, ; etc are also needed.

In addition (or if these characters are needed), HTML encode meta-characters in the response. For example, encode < as &lt;

Reference

• The OWASP guide at http://www.owasp.org/documentation/guide
• http://www.technicalinfo.net/papers/CSS.html
• http://www.cgisecurity.org/articles/xss-faq.shtml
• http://www.cert.org/tech_tips/malicious_code_FAQ.html
• http://sandsprite.com/Sleuth/papers/RealWorld_XSS_1.html