javascriptc#asp.net-mvc-4xssantixsslibrary

Preventing XSS Attack on Form

All:

I have an issue with a project I am working on using C# MVC4

In the project, I am accepting a URL and other parameters from a user, then do some processing and send the result of the processing to the URL provided by the user.

The result is being sent using the following code:

var context = HttpContext.Current;

context.Response.Write("<html><head>");
context.Response.Write("</head><body>");

context.Response.Write(string.Format("<form name=\"myform\" method=\"post\" action=\"{0}\" >", postUrl));

context.Response.Write("</form>");
context.Response.Write("<script type=\"text/javascript\">document.myform.submit();</script></body></html>");

context.Response.Write("</body>");
context.Response.Flush();
context.Response.Clear();
context.ApplicationInstance.CompleteRequest();

Whenever a user attempts an XSS like passing a url value of javascript%3aalert('xss')%2f%2f, the JavaScript runs and the pop up shows up.

I've tried Antixss.HtmlEncode() to encode the URL before passing it into string.Format but still doesn't work. I've tried Antixss.UrlEncode() also, but this gives error as the form doesn't submit to the URL.

Please help me out, Is there something I am missing? What else can I do?

Thanks in advance.

Solution

  • You will need a three pronged approach to solve this issue.

    Preventing XSS injection:

    Note that if a user injected the url value

    " /> <script>alert('xss')</script>

    this would also leave you vulnerable:

    <form name="myform" method="post" action="" /> <script>alert('xss')</script>" >

    Therefore you should use the HttpUtility.HtmlAttributeEncode function to solve this one.

    However, don't stop there. As noted, you should project against javascript: style URLs. For this I would ensure that the URL begins with http:// or https://. If not, throw a SecurityException which you should be logging and handling server-side, and showing the user a custom error page.

    Finally, you want to protect against Open Redirect Vulnerabilities. This is to stop phishing attacks by redirecting users to other domains. Again, use a whitelist approach and ensure that the domain redirected to is one of your own. Be careful on the parsing here, as it is easy to get it wrong - a URL of http://example.org?http://example.com will pass the validation filter for example.com on many badly written validation routines. I recommend using the Uri object in .NET and retrieving the domain through that rather than rolling your own string functions.

    You could also check if the URL is a relative URL, and allow it if acceptable. Use something like this function which uses a built in .NET library to ensure that it is relative or not.