Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What I learned from suffering my first and last XSS attack

livesshattack.net

Post reply on HN
Print view View original

11–20 of 43 posts

Re: What I learned from suffering my first and last XSS attack

#11

Post by WillieStevenson »

CiPHPerCoder wrote: post #10
jacobparker wrote: post #2

Some modern tools to mitigate XSS/make XSS virtually impossible: - Content-Security-Policy https://developer.mozilla.org/en-US/docs/Web/Security/CSP/In... - The sandbox attribute on iframes: https://developer.mozilla.org/en/docs/Web/HTML/Element/ifram... XSS is one of the hardest things to keep under control at scale.

One of the projects I'm working on aims to make it easier to integrate CSP headers into web applicatons. https://github.com/paragonie/csp-builder I'm working this week to integrate it into another project we're developing. (It's MIT licensed, so have fun with it.)

Hi CiPHPerCoder. Can I PM you?

Re: What I learned from suffering my first and last XSS attack

#12

Post by CiPHPerCoder »

WillieStevenson wrote: post #11
CiPHPerCoder wrote: post #10

Earlier quoted context omitted.

One of the projects I'm working on aims to make it easier to integrate CSP headers into web applicatons. https://github.com/paragonie/csp-builder I'm working this week to integrate it into another project we're developing. (It's MIT licensed, so have fun with it.)

Hi CiPHPerCoder. Can I PM you?

On Twitter? Yes, my DMs are open. Feel free to email me too:

    security@ my company's domain name
I'm pretty sure HN doesn't have PMs.

Re: What I learned from suffering my first and last XSS attack

#13

Post by eridius »

paulddraper wrote: post #8
minitech wrote: post #6

Earlier quoted context omitted.

Yep. XSS isn’t at all hard to prevent if you’re using tools that are safe by default. Unfortunately, popular ones like jQuery aren’t. (This, more than any other, is a reason to prefer the DOM API.)

I'm not sure the DOM API is safer. innerHtml vs html()

If you're assigning untrusted text to a property called `innerHTML`, you shouldn't be surprised to learn that you're vulnerable to XSS.

APIs like jQuery are worse because you end up treating strings as HTML without even realizing it. Example from the article:

  $("#tail-here").prepend(newlines);
There's no hint on that line that the `newlines` variable is interpreted as HTML instead of text.

Re: What I learned from suffering my first and last XSS attack

#14

Post by laumars »

The HTML framework I created for personal projects has a special string type that cannot be output (nor even compiled) without specifically selecting which format you want the string encoded as (eg HTML, URL, plain text, etc). While this does produce some arguably uglier code and creates a little additional development overhead (ie code fails to compile by default), it has caught numerous instances where I would have accidentally left myself open to this kind of attack. So I've found it to be highly effective in the long run.

Re: What I learned from suffering my first and last XSS attack

#17

Post by chei0aiV »

laumars wrote: post #14

The HTML framework I created for personal projects has a special string type that cannot be output (nor even compiled) without specifically selecting which format you want the string encoded as (eg HTML, URL, plain text, etc). While this does produce some arguably uglier code and creates a little additional development overhead (ie code fails to compile by default), it has caught numerous instances where I would have…

Strongly-typed languages FTW.
Post reply on HN