Problem - Kevin Tafuro

3.10 Preventing Cross-Site Scripting
Problem
You are developing a web-based application, and you want to ensure that an attacker
cannot exploit it in an effort to steal information from the browsers of other people
visiting the same site.
Solution
When you are generating HTMLthat must contain external input, be sure to escape
that input so that if it contains embedded HTMLtags, the tags are not treated as
HTML by the browser.
Discussion
Cross-site scripting attacks (often called CSS, but more frequently XSS in an effort to
avoid confusion with cascading style sheets) are a general class of attacks with a common
root cause: insufficient input validation. The goal of many cross-site scripting
attacks is to steal information (usually the contents of some specific cookie) from
unsuspecting users. Other times, the goal is to get an unsuspecting user to launch an
attack on himself. These attacks are especially a problem for sites that store sensitive
information, such as login data or session IDs, in cookies. Cookie theft could allow
an attacker to hijack a session or glean other information that is intended to be private.
Consider, for example, a web-based message board, where many different people
visit the site to read the messages that other people have posted, and to post messages
themselves. When someone posts a new message to the board, if the message
board software does not properly validate the input, the message could contain malicious
HTMLthat, when viewed by other people, performs some unexpected action.
Usually an attacker will attempt to embed some JavaScript code that steals cookies,
or something similar.
Often, an attacker has to go to greater lengths to exploit a cross-site script vulnerability;
the example described above is simplistic. An attacker can exploit any page that
will include unescaped user input, but usually the attacker has to trick the user into
displaying that page somehow. Attackers use many methods to accomplish this goal,
such as fake pages that look like part of the site from which the attacker wishes to
steal cookies, or embedded links in innocent-looking email messages.
It is not generally a good idea to allow users to embed HTMLin any input accepted
from them, but many sites allow simple tags in some input, such as those that enable
bold or italics on text. Disallowing HTMLaltogether is the right solution in most
Preventing Cross-Site Scripting | 103
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.