Cross-site Scripting Prevention

An anonymous reader writes "Cross-site scripting (XSS) occurs when an attacker introduces malicious scripts to a dynamic form that allows the attacker to capture the private session information. This article casts light on the areas vulnerable to XSS exploitation, explains how the user can protect himself, and details what the webmaster can do to secure a site from this type of malicious intrusion."

Comments

Fantastic article

[GoRK]

This is a very good article on the subject that does a good job of explaining it from both ends, though it's a little perl heavy for no really good reason -- plus it ignores a lot of better and easier techniques to prevent cross-site scripting problems if you actually are using perl or mod_perl.

There is a problem in Listing 5, though. The article says the script is vulnerable because it blindly prints an input value back to the user; however, it only prints the word "parameter" back to the user and is thus not really vulnerable to anything. Looks like they left out a "$".

Re:Extremely common

[DukeyToo]

Its not so hard, and the sanitizing/encoding cpu cycles are well worth the trouble - far better than trying to second guess how much you trust data.

From the article "...can occur when:

1. A Web server does not take adequate steps to ensure that the properly encoded pages are generated.
2. An input is not suitably validated."

So, validate/sanitize your inputs, and properly encode your outputs. Its not rocket science.

Another article

[BeatdownGeek]

Funny, I just happened to come across another article on the same topic here.

Re:I'm confused

[Carnildo]

Can't you do all the same things via a man-in-the-middle attack, in which case there is NO way for the web site developer to guard against it?

You can, but it's a hell of a lot easier to sneak tainted data into a form than it is to set up a man-in-the-middle attack. Further, XSS can guarantee you information on everyone who views the tainted page, while a MITM attack can't.