Prevent XSS in uri parameters in PHP

Question

In my application, an attacker can pass in the URI something like this:

http://domain/someapi?entryId=d2rf<script>alert("gotcha")</script>f334&param2=....

What are the steps that I need to take to prevent it. I can't seem to find a good answer for this, even in OWASP site. According to OWASP every character with ascii value of less than 256 is ok.

I also don't want some very generic solution such as sanitizing each param by striping it's <> signs.

Answer 1

OK, let's use an example. You have a search page that takes a GET parameter for the search query.

http://example.com?search=test+search

On your search page, you do something like this.

<p>your search results for "{search}":</p>

This is vulnerable to reflected XSS. The following query:

http://example.com?search=<script>alert(1);</script>

would result in the following HTML:

<p>your search results for "<script>alert(1);</script>":</p>

Obviously, that's not good, as it will execute the script (well, the XSS Auditor will probably block it, but we don't depend on that). The first thing we can do to help prevent XSS is to escape this string since it is un-trusted and comes from the client.

<p>your search results for "{HTML.Escape(search)}":</p>

The syntax for this, of course, depends on your server-side language. In general, you are looking for HTMLEncode/Escape/etc. I'm sure someone can point you to a function or library for doing this in PHP.

Now that we escape the string, our output would look like this:

<p>your search results for "&lt;script&gt;alert(1)&lt;/script&gt;":</p>

That will show up as < in the browser, but the source will be encoded (<).

This is the general overview of preventing most XSS. Manually escaping every input can be a little risky, cause you might forget one. So you want to use some kind of templating system. There are different things you do for HTML attributes/javascript strings/html entities, etc.

Google has a great introductory resource for this:

https://www.google.com/about/appsecurity/learning/xss/#PreventingXSS

Answer 2

According to OWASP every character with ascii value of less than 256 is ok.

What? No. XSS prevention depends on context! I'm also very sure that OWASP doesn't regard every ASCII value less than 256 as okay, since ASCII is only defined for characters 0 - 127.

I also don't want some very generic solution such as sanitizing each param by striping it's <> signs

If an attacker supplies malicious Javascript code in a URL parameter, you cannot prevent them from doing that. What you can do is make sure your application doesn't blindly echo this value back to the user, or else you've opened the door to a reflective cross-site scripting vulnerability.

Do you need to accept and reflect (display) arbitrary HTML code?

• Yes: Use HTML Purifier.
• No: One of the following should be safe to use:
  • htmlentities($yourStringVariable, ENT_QUOTES | ENT_HTML5, 'UTF-8');
  • For URLs only: http_build_query($yourArrayOfKeysAndValues); or urlencode($string);

Demo: http://3v4l.org/itUZX