RE: Fixing XSS Vulns

["Cyrill Osterwalder" <cyrill.osterwalder () seclutions com>]

wilsonc wrote:
> I'm not a security expert, but I did some googling and found
> that the standard procedure is basically to "encode" the string
> before displaying it to the user

There is one issue I'd like to add to the already advanced discussion:

Other than widely assumed, the most critical XSS vulnerabilities are *NOT* in
HTML text that is readable to the user. Make sure that you also secure all
dynamic echo of non-visible elements. This is where most Web developers
forget to implement security mechanisms. 

I'm talking about

- dynamic URLs/HREFs that include any kind of 
  externally modifieable input 
  (e.g. index numbers, keys, string elements)

- hidden fields that contain any kind of
  externally modifieable input
  (e.g. last search term, basket index, etc.)

- any kind of externally modifieable input that
  shows up ANYWHERE in javascript

- and there's a lot more... ;-)

Please make sure that you do not only take visible HTML echoes into account
but all possible HTML source echoes. An attacker analyzes all HTML source
output for possible echoes, not just what he sees. And there are by far more
out there than of the visible ones.

Best regards

Cyrill Osterwalder

Chief Technology Officer
Seclutions AG

http://www.seclutions.com