Day 2: Avoid Cross-site scripting (XSS) using ColdFusion 10 - Part 1
"Cross-site scripting (XSS) is a type of computer insecurity vulnerability typically found in Web applications (such as web browsers through breaches of browser security) that enables attackers to inject client-side script into Web pages viewed by other users. A cross-site scripting vulnerability may be used by attackers to bypass access controls such as the same origin policy. Cross-site scripting carried out on websites accounted for roughly 80.5% of all security vulnerabilities documented by Symantec as of 2007. Their effect may range from a petty nuisance to a significant security risk, depending on the sensitivity of the data handled by the vulnerable site and the nature of any security mitigation implemented by the site's owner." - Wikipedia
Encodes the input string for use in HTML and returns encoded String.
Below is sample code trying render HTML content variable stored in ColdFusion variable. Let's assume variable value coming through user input (may be comment on blog post) which will be displayed in blog comment area right below post.
<cfsavecontent variable="htmlcontent"> <div> Here is <i>test</i> html content includes<br/> <script>alert('hello')</script> Notice how & rendered with both functions. </div> </cfsavecontent> <cfoutput>#htmlcontent#</cfoutput> <hr/> <cfoutput>#htmleditformat(htmlcontent)#</cfoutput> <hr/> <cfoutput>#encodeForHTML(htmlcontent)#</cfoutput>
And here is output...
I have tried to annotate and highlight to distinguish changes.
<cfoutput>#htmlcontent#</cfoutput> is most dangerous statement when you are rendering direct input from user. Notice that 'test' displayed in italic and script doesn't rendered instead "hello" will be alerted on browser. Means we are opening all doors for attacker for XSS attach. There can be any dangerous script instead of alert('hello').
Second output statement look good and it displayed HTML code instead of rendering HTML output on screen but doesn't render properly already encoded & since htmlEditFormat function simply encode <, >, & and " characters without know what your content is.
encodeForHTML is smart, it knows what already encoded in HTML and what not. Also this function is not limited to encode fix number of characters instead it encode almost all non alphanumeric characters.
encodeForHTML will not always work to avoid XSS attack. encodeForHTMLAttribute can be use if you using coldfusion variable to be rendered through html tag attribute. Below sample code where I try to show how dangerous it can be if we are not doing proper encoding.
<cfset attrValue="Male"" onclick='alert(""script executed on click"")'"> <cfoutput> Without using encoded for HTML Attribute <input type="text" name="gender" value="#attrValue#"/><br/> <hr/> With encoded Attribute <input type="text" name="gender" value="#encodeForHTMLAttribute(attrValue)#"/><br/> </cfoutput>
Here is generated HTML output
Without using encoded for HTML Attribute <input type="text" name="gender" value="Male" onclick='alert("script executed on click")'"/><br/> <hr/> With encoded Attribute <input type="text" name="gender" value="Male" onclick='alert("script executed on click")'"/><br/>
I guess ColdFusion use well known ESAPI to implement all this security function. I will cover some more security functions tomorrow's post.
Hope this help.