You are viewing a plain text version of this content. The canonical link for it is here.
Posted to general@jakarta.apache.org by Jon Stevens <jo...@latchkey.com> on 2001/11/19 23:38:52 UTC
Cross site scripting
Sadly, it seems that the Java world really hasn't taken the cross site
scripting issues seriously. Only a few projects within Jakarta have really
made an effort to fix bugs and that was after they were pointed out by
others. It also seems that most of the examples are for other languages
(PHP, Perl, C) and not Java and that they have made simple methods available
to resolve the issues.
It would be really cool to start a project under Jakarta (ie: in commons)
that addresses the issues of the cross site scripting bugs in a re-usable
fashion so that more people will be aware of the issues surrounding this
important discovery.
Does anyone have code they want to contribute to get this started? How are
you currently dealing with these issues? What is your favorite way to escape
things? Do you filter/escape all content or only some content? Etc.
Thanks,
-jon
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
Re: Cross site scripting
Posted by Jon Stevens <jo...@latchkey.com>.
on 11/20/01 12:43 PM, "Steve Giovannetti" <st...@hubcitymedia.com> wrote:
> I was trying to look at this from the standpoint of how does the
> offending script get on your site in the first place. Let's say you
> have a discussion board and you want to make sure no one puts nasty suff
> in SCRIPT tags in their postings. But from what I gather is your
> interested in blocking on the way out. I'll re-read the CERT advisory.
>
> gio
No real point on blocking it on the way in...
-jon
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
Re: Cross site scripting
Posted by Steve Giovannetti <st...@hubcitymedia.com>.
I was trying to look at this from the standpoint of how does the
offending script get on your site in the first place. Let's say you
have a discussion board and you want to make sure no one puts nasty suff
in SCRIPT tags in their postings. But from what I gather is your
interested in blocking on the way out. I'll re-read the CERT advisory.
gio
Jon Stevens wrote:
>on 11/20/01 10:58 AM, "Steve Giovannetti" <st...@hubcitymedia.com> wrote:
>
>>In the interest of breaking the chains of my cross site scripting
>>ignorance, I'm assuming that the offending SCRIPT needs to be blocked
>>from POST or GET requests made by users to JSP/Servlets on the target
>>server?
>>
>
>Nope. The only thing that needs to be done is that certain content needs to
>be filtered when it is sent to the browser client so that it is not
>interpreted by the client in a bad way.
>
>> Wouldn't an input filter on the servlet just do the trick?
>>
>
>Filtering all of the content would be a performance killer and doesn't make
>much sense. You also don't want to filter input, only output.
>
>I'm not trying to solve the problem of doing the filtering of the content
>that I want to filter...I know how to do that...I'm trying to solve the
>problem that no one has created any code in Java (that I can find) to deal
>with the CSS issue itself.
>
>Part of the problem with this security hole is that, for some reason, it is
>hard for a lot of people to even get a basic comprehension of it (even
>though it is so well documented). I think that is why a lot of people just
>ignore it as being a problem.
>
>-jon
>
>
>--
>To unsubscribe, e-mail: <ma...@jakarta.apache.org>
>For additional commands, e-mail: <ma...@jakarta.apache.org>
>
>
>
>
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
RE: Cross site scripting
Posted by Danny Angus <da...@thought.co.uk>.
> -----Original Message-----
> From: Jon Stevens [mailto:jon@latchkey.com]
> Part of the problem with this security hole is that, for some
> reason, it is
> hard for a lot of people to even get a basic comprehension of it (even
> though it is so well documented). I think that is why a lot of people just
> ignore it as being a problem.
I think people also shy away from it as being hard to solve, which it isn't,
and intrusive, which is possibly is.
It only takes a demonstration to illuminate most programmers to the danger,
after all its so simple to exploit and so simple to prevent that its scary.
d.
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
Re: Cross site scripting
Posted by Jon Stevens <jo...@latchkey.com>.
on 11/20/01 10:58 AM, "Steve Giovannetti" <st...@hubcitymedia.com> wrote:
> In the interest of breaking the chains of my cross site scripting
> ignorance, I'm assuming that the offending SCRIPT needs to be blocked
> from POST or GET requests made by users to JSP/Servlets on the target
> server?
Nope. The only thing that needs to be done is that certain content needs to
be filtered when it is sent to the browser client so that it is not
interpreted by the client in a bad way.
> Wouldn't an input filter on the servlet just do the trick?
Filtering all of the content would be a performance killer and doesn't make
much sense. You also don't want to filter input, only output.
I'm not trying to solve the problem of doing the filtering of the content
that I want to filter...I know how to do that...I'm trying to solve the
problem that no one has created any code in Java (that I can find) to deal
with the CSS issue itself.
Part of the problem with this security hole is that, for some reason, it is
hard for a lot of people to even get a basic comprehension of it (even
though it is so well documented). I think that is why a lot of people just
ignore it as being a problem.
-jon
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
Re: Cross site scripting
Posted by Steve Giovannetti <st...@hubcitymedia.com>.
In the interest of breaking the chains of my cross site scripting
ignorance, I'm assuming that the offending SCRIPT needs to be blocked
from POST or GET requests made by users to JSP/Servlets on the target
server? Wouldn't an input filter on the servlet just do the trick?
gio
Jon Stevens wrote:
>Wow, you fit my first paragraph perfectly.
>
>http://httpd.apache.org/info/css-security/index.html
>
>-jon
>
>
>on 11/20/01 5:11 AM, "Steve Giovannetti" <st...@hubcitymedia.com> wrote:
>
>>What exactly do you mean by "cross site scripting" and could you give
>>pointers to the examples your talking about in PHP, Perl and C?
>>
>>gio
>>
>>Jon Stevens wrote:
>>
>>>Sadly, it seems that the Java world really hasn't taken the cross site
>>>scripting issues seriously. Only a few projects within Jakarta have really
>>>made an effort to fix bugs and that was after they were pointed out by
>>>others. It also seems that most of the examples are for other languages
>>>(PHP, Perl, C) and not Java and that they have made simple methods available
>>>to resolve the issues.
>>>
>>>It would be really cool to start a project under Jakarta (ie: in commons)
>>>that addresses the issues of the cross site scripting bugs in a re-usable
>>>fashion so that more people will be aware of the issues surrounding this
>>>important discovery.
>>>
>>>Does anyone have code they want to contribute to get this started? How are
>>>you currently dealing with these issues? What is your favorite way to escape
>>>things? Do you filter/escape all content or only some content? Etc.
>>>
>>>Thanks,
>>>
>>>-jon
>>>
>
>
>--
>To unsubscribe, e-mail: <ma...@jakarta.apache.org>
>For additional commands, e-mail: <ma...@jakarta.apache.org>
>
>
>
>
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
Re: Cross site scripting
Posted by Jon Stevens <jo...@latchkey.com>.
Wow, you fit my first paragraph perfectly.
http://httpd.apache.org/info/css-security/index.html
-jon
on 11/20/01 5:11 AM, "Steve Giovannetti" <st...@hubcitymedia.com> wrote:
> What exactly do you mean by "cross site scripting" and could you give
> pointers to the examples your talking about in PHP, Perl and C?
>
> gio
>
> Jon Stevens wrote:
>
>> Sadly, it seems that the Java world really hasn't taken the cross site
>> scripting issues seriously. Only a few projects within Jakarta have really
>> made an effort to fix bugs and that was after they were pointed out by
>> others. It also seems that most of the examples are for other languages
>> (PHP, Perl, C) and not Java and that they have made simple methods available
>> to resolve the issues.
>>
>> It would be really cool to start a project under Jakarta (ie: in commons)
>> that addresses the issues of the cross site scripting bugs in a re-usable
>> fashion so that more people will be aware of the issues surrounding this
>> important discovery.
>>
>> Does anyone have code they want to contribute to get this started? How are
>> you currently dealing with these issues? What is your favorite way to escape
>> things? Do you filter/escape all content or only some content? Etc.
>>
>> Thanks,
>>
>> -jon
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
Re: Cross site scripting
Posted by Steve Giovannetti <st...@hubcitymedia.com>.
What exactly do you mean by "cross site scripting" and could you give
pointers to the examples your talking about in PHP, Perl and C?
gio
Jon Stevens wrote:
>Sadly, it seems that the Java world really hasn't taken the cross site
>scripting issues seriously. Only a few projects within Jakarta have really
>made an effort to fix bugs and that was after they were pointed out by
>others. It also seems that most of the examples are for other languages
>(PHP, Perl, C) and not Java and that they have made simple methods available
>to resolve the issues.
>
>It would be really cool to start a project under Jakarta (ie: in commons)
>that addresses the issues of the cross site scripting bugs in a re-usable
>fashion so that more people will be aware of the issues surrounding this
>important discovery.
>
>Does anyone have code they want to contribute to get this started? How are
>you currently dealing with these issues? What is your favorite way to escape
>things? Do you filter/escape all content or only some content? Etc.
>
>Thanks,
>
>-jon
>
>
>--
>To unsubscribe, e-mail: <ma...@jakarta.apache.org>
>For additional commands, e-mail: <ma...@jakarta.apache.org>
>
>
>
>
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
RE: Cross site scripting
Posted by Danny Angus <da...@thought.co.uk>.
Not Java, but I guess that just Illustrates the point you're making! :-)
I'd be happy to translate some of my perl if you like.
d.
> -----Original Message-----
> From: Jon Stevens [mailto:jon@latchkey.com]
> Sent: Tuesday, November 20, 2001 6:44 PM
> To: general@jakarta.apache.org
> Subject: Re: Cross site scripting
>
>
> on 11/20/01 7:43 AM, "Danny Angus" <da...@thought.co.uk> wrote:
>
> > filter everything for public consumption its safest, its not
> just <SCRIPT>
> > you have to watch out for its also pernicious things like <P
> > onMouseOver="foo();"> which may not work often, but you don't want it to
> > *ever*, and who is to say which inline event handler will or
> won't work on
> > what browser now or in the future, its really the only safe way IMO.
>
> Do you have some code you can contribute for this?
>
> -jon
>
>
> --
> To unsubscribe, e-mail: <ma...@jakarta.apache.org>
> For additional commands, e-mail: <ma...@jakarta.apache.org>
>
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
Re: Cross site scripting
Posted by Jon Stevens <jo...@latchkey.com>.
on 11/20/01 7:43 AM, "Danny Angus" <da...@thought.co.uk> wrote:
> filter everything for public consumption its safest, its not just <SCRIPT>
> you have to watch out for its also pernicious things like <P
> onMouseOver="foo();"> which may not work often, but you don't want it to
> *ever*, and who is to say which inline event handler will or won't work on
> what browser now or in the future, its really the only safe way IMO.
Do you have some code you can contribute for this?
-jon
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
RE: Cross site scripting
Posted by Danny Angus <da...@thought.co.uk>.
> -----Original Message-----
> From: Jon Stevens [mailto:jon@latchkey.com]
> Sadly, it seems that the Java world really hasn't taken the cross site
> scripting issues seriously.
<snip>
>How are
> you currently dealing with these issues? What is your favorite
> way to escape
> things? Do you filter/escape all content or only some content?
filter everything for public consumption its safest, its not just <SCRIPT>
you have to watch out for its also pernicious things like <P
onMouseOver="foo();"> which may not work often, but you don't want it to
*ever*, and who is to say which inline event handler will or won't work on
what browser now or in the future, its really the only safe way IMO.
d.
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>