Will HTML Encoding prevent all kinds of XSS attacks?

by

No.

Putting aside the subject of allowing some tags (not really the point of the question), HtmlEncode simply does NOT cover all XSS attacks.

For instance, consider server-generated client-side javascript – the server dynamically outputs htmlencoded values directly into the client-side javascript, htmlencode will not stop injected script from executing.

Next, consider the following pseudocode:

<input value=<%= HtmlEncode(somevar) %> id=textbox>

Now, in case its not immediately obvious, if somevar (sent by the user, of course) is set for example to

a onclick=alert(document.cookie)

the resulting output is

<input value=a onclick=alert(document.cookie) id=textbox>

which would clearly work. Obviously, this can be (almost) any other script… and HtmlEncode would not help much.

There are a few additional vectors to be considered… including the third flavor of XSS, called DOM-based XSS (wherein the malicious script is generated dynamically on the client, e.g. based on # values).

Also don’t forget about UTF-7 type attacks – where the attack looks like 

+ADw-script+AD4-alert(document.cookie)+ADw-/script+AD4-

Nothing much to encode there…

The solution, of course (in addition to proper and restrictive white-list input validation), is to perform context-sensitive encoding: HtmlEncoding is great IF you’re output context IS HTML, or maybe you need JavaScriptEncoding, or VBScriptEncoding, or AttributeValueEncoding, or… etc.

If you’re using MS ASP.NET, you can use their Anti-XSS Library, which provides all of the necessary context-encoding methods.

Note that all encoding should not be restricted to user input, but also stored values from the database, text files, etc.

Oh, and don’t forget to explicitly set the charset, both in the HTTP header AND the META tag, otherwise you’ll still have UTF-7 vulnerabilities…

Some more information, and a pretty definitive list (constantly updated), check out RSnake’s Cheat Sheet: http://ha.ckers.org/xss.html

More Related Contents:

  1. Best way to handle security and avoid XSS with user entered URLs
  2. What is cross site scripting?
  3. xss attack on a php page
  4. How does the SQL injection from the “Bobby Tables” XKCD comic work?
  5. How can I sanitize user input with PHP?
  6. Salt Generation and open source software
  7. Is “double hashing” a password less secure than just hashing it once?
  8. Authentication versus Authorization
  9. Where to store JWT in browser? How to protect against CSRF?
  10. Remove Server Response Header IIS7
  11. Best way to defend against mysql injection and cross site scripting
  12. Is it safe to enable CORS to * for a public and readonly webservice?
  13. Has reCaptcha been cracked / hacked / OCR’d / defeated / broken? [closed]
  14. What is the purpose of base 64 encoding and why it used in HTTP Basic Authentication?
  15. Differences Between Rijndael and AES
  16. Why are porn sites appearing in my Google Analytics data?
  17. Is there any possible ways to bypass cloudflare security checks?
  18. Send mail via Gmail with PowerShell V2’s Send-MailMessage
  19. Is JSONP safe to use?
  20. Using Symfony2’s AccessDeniedHandlerInterface
  21. Is it safe to enable ”Access-Control-Allow-Origin: *“ (wildcard) for a public and readonly webservice?
  22. Why not use HTTPS for everything?
  23. Where is the PEM file format specified?
  24. Difference between CSRF and X-CSRF-Token
  25. MD5 security is fine? [closed]
  26. SSO with CAS or OAuth?
  27. Best practices for server-side handling of JWT tokens [closed]
  28. How do I secure REST API calls?
  29. What are best practices for securing the admin section of a website? [closed]
  30. How can I hash passwords in postgresql?

Leave a Comment