the-web-application-hackers-handbook

524 Chapter 13 n Attacking Users: Other Techniques
Furthermore, in a technique similar to the CSS injection attack described
previously, it was sometimes possible to inject text at appropriate points within
a target application’s HTML response to wrap an arbitrary {...} block around
sensitive data contained within that response. The whole response could then
be included cross-domain as a script to capture the wrapped data.
Neither of the attacks just described works on current browsers. As this process
continues, and browser support for novel syntactic constructs is further
extended, it is likely that new kinds of cross-domain data capture will become
possible, targeting applications that were not vulnerable to these attacks before
the new browser features were introduced.
Preventing JavaScript Hijacking
Several preconditions must be in place before a JavaScript hijacking attack can
be performed. To prevent such attacks, it is necessary to violate at least one
of these preconditions. To provide defense-in-depth, it is recommended that
multiple precautions be implemented jointly:
n As for requests that perform sensitive actions, the application should
use standard anti-CSRF defenses to prevent cross-domain requests from
returning any responses containing sensitive data.
n When an application dynamically executes JavaScript code from its own
domain, it is not restricted to using tags to include the script.
Because the request is on-site, client-side code can use XMLHttpRequest to
retrieve the raw response and perform additional processing on it before it
is executed as script. This means that the application can insert invalid or
problematic JavaScript at the start of the response, which the client application
removes before it is processed. For example, the following code causes
an infinite loop when executed using a script include but can be stripped
before execution when the script is accessed using XMLHttpRequest:
for(;;);
n Because the application can use XMLHttpRequest to retrieve dynamic script
code, it can use POST requests to do so. If the application accepts only POST
requests for potentially vulnerable script code, it prevents third-party
sites from including them using tags.
The Same-Origin Policy Revisited
This chapter and the preceding one have described numerous examples of
how the same-origin policy is applied to HTML and JavaScript, and ways
in which it can be circumvented via application bugs and browser quirks.