zoloft rash doxycycline 100mg prices canada 100 mg aspirin order levitra online why does cialis cost so much risperdal lawsuit settlement kesan postinor 2 methocarbamol online buying vigara on line cialis canada pharmacy reviews i need albenza overnight buy propeciatablets online herbal viagra reviews antibiotics for ear infections in dogs amoxicillin and clavulanate potassium for dogs avalide 300 12.5 coupons imagen de futbol con frases equivalencia simvastatina atorvastatina international pharmacy cialis euroclinix hasselt winterland valtrex and breastfeeding prevacid coupons 2015 duralis tadalafil side effect of perkinil tablet computers aldactone medication hair loss in women prednisone and pregnancy symptoms para que es el diclofenaco sodico 50 mg kamagra recommended sites fluconazol and ovulation zanaflex dosage glucophage weight loss doctor citalopram 20 mg street value nizagara 100 mg for sale paxil for sale microcidal 125mg thc rythmol medication drug interactions tryptizol 25mg vigraa online forum prevacid lansoprazole 30mg lynoral online oracef antibiotic side amlodipine order online canadian pharmacy levitra pay by paypal medrol dosepak side effects facial flushing procalisx scam report real pfiefer viagra citalopram no script buy viagera online binotal ampicilina capsulas is 20 mg zestri speedy rx pharmacy deltasone dose pack directions name of viagra tablet in in levitra 20 mg impotence causes prednisone abuse zovirax acyclovir ointment buy viagra no orsscriotion medrol dose pack instructions in spanish premarin side effects drugs sotalol side effects treatment condyline pdf to word cheap viagra japan can you buy viagra in the bahamas voltaren 75mg medication tadapox reviews on apidexin when is cialis most effective pilocarpine ocular system photoplanetdrugs naproxen side effects doctor decadron dosage information amerimedrx scamper need snafi online claritin ingredients allergy magnesium deficiency symptoms marijuana nexium for 18 00 does metronidazole turn urune irange pharmacy supply at cheap cialis phenegran without prescription phenergan medication 24hour candian pharmcy spiriva coupons printable viagra tablet price in pakistan mupirocin uses nose can i buy cialis in ireland artane side effects manly tablets viagra 100 mg canadian ed medications doxycycline accord disper tablet 100mg mebendazole vermox over the counter fosamax and jaw bone problems cialis on line melbourne vic fast del viagra moins cher ocean fitness benoquin cream 40 depigmentation cream sildegra 100mg zoloft tylenol pm side effects mesterolone steroid side salbutamol ventolin expectorant paxil side effects go propranolol for migraines in children vidalta bosques caducifolios procalisx scampi medyka poland map topamax side effects topamax dosage for weight loss buy ondansetron without prescription phenergan for stomach virus viagra or cialis cheap probenecid side effects medication therapy appointment therapist log in levitra generika preisvergleich rimadyl side effects in dogs prevacid 30 mg over the counter clonidine hcl 0.1mg maxalt 10 mg mlt binozyt 500mg generic cialis india clozaril blood monitoring guidelines fanegada wikianswers zovirax acyclovir ointment 5 purchase metformin without prescription penegra tablets india losartan side effects cozaar kmart generic drug list aurochem pharmaceuticals estrofem for transitioning to toddler betagesic tablets under $100 sky pharmacy wellbutrin robaxin dosage for women buy viagra online without script sinequanone definition of love promethazine in canada scoria incorporation india viagra cash on delivery drug store xanax and alcohol withdrawal propecia side effects women viagra for sale paypal lisinopril side effects erectile dysfunction original viagrakagra pfizer secnidazole tablets 500 mg canadian pharma companies lipitor iraplax orlistat 120mg en probenecid drug interaction synthroid medication interactions brahmi herbal benefits buy generic viagra with pay pal neurocet painkiller drink pulmicort respules children buy low cost viagra terbutaline dosage preterm labor minocycline buy 50mg rimadyl side effects panting healtyman viagra without a doctor pyridium medication over the counter benemid probenecid canadian pharmacy no rx elavil cheaper alternative to flovent fluzol 200mg equalsfolcres horny goat weed viagra en gotas para hombres can you buy viagra without prescription express canadian drugs lamisil code vasotec contraindications of nitroglycerin xeloda 500mg doctor prinivil side effects cant access kamagraforyou prevacid vs nexium vs aciphex healthy man complaints xylocaine jelly 2 medicine store order propanonal generic name for prednisone carprofen 100 mg for dogs topiramate 25mg zyd side effects hydroxyzine hcl 25 mg tablet over the counter cymbalta antidepressant drug has anyone had generic viagra cheap cialis india meclizine 25 mg tablet directions buy antibiotics with out prescription canadian rx online macrobid antibiotic macrobid side effects buy viagra 50mg sildenmax viagra inderalici para que sirve obetrol drug emporium prednisone no prescription medication paracetamol indications the blue pill pharmacy brand viagra without a prescription dutasteride or finasteride side effects zocor information grapefruit lergigan fass puretone music neil young xenical from philippines acheter viagra viramune 200mg progesterone flexeril medication information percocet and alcohol combination number 1 canadian pharmacy antabuse reaction time pregnant celebrities due in 2015 discount pharmacy viagra indocin dosage for headaches premarin coupon with insurance caffeine and pregnancy mayo clinic femara side effects letrozole fertility viagra kaufen paypal sildenafil citrate 100mg from india celecoxib 200mg en espanol nizoral 2 shampoo morroco viagra aldactone spironolactone for acne antibiotics online trusted sites phenergan for nausea when pregnant letrozole side effects blog levitra generico miglior prezzo india garlic bread recipe for bread machine warfarin drug interactions with acetaminophen plendil side effects taking does thorazine have street value trittico e muscoril cypro without a prescription tramadol loan online nitrazepam tablets bp cholesterol diet plan for high cholesterol where to buy cialis tablets accutane canada pharmacy buy alli international shipping use of terbutaline in pregnancy kamatra gelato citalopram 20 mg treatment estradiol side effects estrogen represa de cachi mupirocin ointment usp 2 used to treat shingles venta online finasteride advair side effects in children cs online support24 zofran medication classification lumigan 0.01 vs 0.03 buy 1000 mg single dose zithromax macrobid for uti dosage canada pharmicy 200g viagra on line chemist serum digoxin toxicity level kosovarja gazeta shqiptare tirana chat link phones diabecon dosage calculator medrol dose pack no prescription buy avodart in uk software engineer salary in philippines where to buy augmentin sildenafil citrate chewable tablets accredited online viagra pharmacy purchase cialis from north america clomid 100 mg tablets to buy hydrea side effects hydroxyurea dosage patent expiration for viagra no prescription arimidex cheap percocet indian pharmacy buy viagra without rx colchicine india prandin side effects repaglinide cost diane kruger insurance marketplace erectile dysfunction edmonton buy metaprolol online cheap good viagra uk viagra kaufen in hamburg diroton bgc fosamax and jaw problems drugs zometa calculator tramadol 200mg needed pills cheapest and fastest delivery of cialis doxycycl hyc 100mg doxazosin 8 mg side effects buying viagra over internet lamictal rash images albuterol sulfate inhalation solution 0.083 e buy uk celebrex side effects medications regenon for sale tryptizol information systems where to buy terramycin ointment for cats corega denture adhesive side effects herbal accutane kemadrin discontinued wallpaper priority mail 2 day delivery on cialis malaseb shampoo gallon size ivermectin scabies emedicine saroten nebenwirkungen ibuprofen walmart pharmacy cialis price glipizide xl without rx 365 pillsbury buy betnovate online benadryl ingredients diphenhydramine wellbutrin sr metformina clorhidrato 500 mg ramipril 10mg cap zyd dikloron jelqing where to buy propecia forums reglan dosage sky pharmacy canada mail order orderpharma topix pikeville cialis generic brand sold in australia buy propecia buy cefixime online kemadrin tablets at walmart letrozole bodybuilding doses lerk sildenafil 100mg minoxidil for women side effects can i use ivermectin for horses on my dog fluconazole diflucan and breastfeeding 10 mg propanol online overnight walgreens pharmacy locations new orleans diane von furstenberg luggage eulexin medication for anxiety losartan potassium hydrochlorothiazide 100mg/25mg kamatra sumatra volcano oracea side effects weight gain rapidtabs viagra vs cialis no prescription diclofenac mail prescriptions from canada esomeprazole sodium vs esomeprazole magnesium lavestra tablettabletlavitralaxadin bactroban crema buy promethazine tablets for allergy keflex and breastfeeding cephalexin ropinerole no prescription skelaxin muscle relaxer side effects voltaren gel macrobid antibiotic pregnancy buy dapoxetine online uk indocin medication in pregnancy is cipla ltd a legitimate drug mfg mebendazole over the counter canada norstan apparel permethrin cream coupons order propanolol cheap no prescription insurance adjuster jobs in georgia tinidazole 500mg price sotalol medication tab colors 120mg h2s/14 viagra online canadian pharmacy scam viagra ne shqip remeron antidepressant mirtazapine side effects levoxyl medication recall cheap medicine buy suboxone film online motilium without a script overnight meds online pregnancy test calculator vimax side effects impotence micardis coupons kemadrin 5mg oxycodone relafen uses and side effects condyline 5 nation amlodipine besylate side effects hair loss no prescription canadian pharmacy cholesterol levels and alcohol zoloft for sale no prescription average cost of cialis prescription percocet 512 information side effects viagra canada cheap hydroxyzine buy fasigyn 500mg tablets parcopa discontinued waverly fabrics levomax 500 uputstvo dentopain fortels foam rogaine for women reviews sertraline hcl 100mg high buying cilias safely gabapentin online vipps best reviews deals on cialis viagra sale in qatar 274 keflex 500mg cephalexin medication cyclidox tablets levitra generic for sale augmentin and alcohol use cialis kantucky como fazer uma picareta do minecraft buy dexamethasone without prescription cefixime trihydrate api flomax for women with multiple sclerosis keppra side effects seizure levetiracetam does pregnenolone cause weight gain accutane comprar ovral l online paxil online pharmacy oxybutynin medication side effects maxalt by mail glipizide medication side effects best online pharmacy review discount cialis 20mg levitra side effects medications very lowest price on sildenafil does generic viagra have a shelf life 1 canadian drug store to buy viagar oxybutynin chloride 5mg tabs tadalista review rx one pharmacy canada non generic clindamycin without rx lowest price on online order of kamagra doxazosin mesylate 2mg tadalafil 10mg maxalt 10 mg dosing prevacid vs prilosec nexium lotrisone cream otc moduretic dosage of tylenol order effexor online no prescription rogaine rebate 2015 cymbalta online pharmacy valsartan generic release date bactrim ds online symptoms of digoxin toxicity levels zestoretic side effects lisinopril mg primitine mist inhalers piroxicam for dogs with thyroid cancer subutex for sale online canadian pharmacy no script needed cheap levitra on line in the uk vera bradley fabric by the yard legit viagra online promethazine dm ingredients antibiotics mexico order proventil hfa for sale buy tetracycline canada clindamicina dosis recomendada flovent diskus package insert viagra in melbourne shop online with echeck sifrol medication interaction eutirox 25 prospect tadalafil cipla reviews lamictal side effects in children protonix side effects doctor canada toronto drug store levitra bestellen ohne rezept supreme suppliers mumbai pergotime tablets with windows binotal 500 mg bayer proviron impotence compound antabuse alcohol treatment metallica one lyrics video buy cialis online no prescription proventil coupon 2013 metformin weight loss polycystic ovary syndrome stanozolol side effects cycle clopidogrel bisulfate plavix fast act viagra hydroxyzine pamoate 25mg cost sumycin tetracycline stained is zanaflex addiction www foriegncountrythatsellscafergot walgreens pharmacy drugs confidex reviews 50 optimmune o.2 3.5gm tube canadian pharmacy abortion pills lamictal bipolar depression voltaren gel coupon card order zpak online std 250 mg azithromicyn serax oxazepam medication elomet cream side effects healthcare provider cialis to buy in usa tryptizol information literacy nitrazepam vs diazepam 2mg buy tetracycline 500mg avapro generic phenergan suppository dose sofilex wiki midamor diuretic side brand name cialis overnight mebendazole dosage for worms anafranil for ocd forum neurontin for anxiety medication zithromax 500mg dosage sildenafil citrate 100mg side effects www 24hourcanadapharmacy haldol decanoate injection dosing where to purchase alli 60 mg in europe indinavir contraindications to breastfeeding genuine viagra best price manfaat ciprofloxacin buy std antibiotics lamictal for depression treatment vega 100 tablets use in urdu non prescription canadian perlutex veterinary schools cialis 50 glipizide side effects side effects cialis from hong kong esomeprazole vs omeprazole nebivolol hydrochloride side effects stenotrophomonas maltophilia septra buy cheap cialis discount online xl pharmacy vip transactions no perscription amoxicillian stieva a online antibiotics uk online neurocet painkiller recipe vilches radio
Home Forum Download/Upload Links Search

NetTalk User Group

NetTalk User Group Meeting!
Live Webinar!
Saturday Nov. 16 
7am PST
Click Here To Register!
Home arrow Forum arrow NetTalk Web Serverarrow Web Server - Share Knowledgearrow Security: HTML Injection / XSS attacks.
NetTalk Central
October 07, 2015, 01:04:04 PM *
Welcome, Guest. Please login or register.

Login with username, password and session length
News: Welcome to the NetTalk Central Forums!
   Home   Help Search Login Register  
Pages: [1]
Author Topic: Security: HTML Injection / XSS attacks.  (Read 2490 times)
Global Moderator
Hero Member
Posts: 7770

View Profile
« on: August 16, 2012, 02:01:09 AM »

HTML Injection is a security issue which occurs when you let users enter "html" content. So, for example, if you have a text control on a form, and Allow xHTML is on, then you're allowing the user to enter HTML and content, and then you will display that content using their HTML markup.

Unfortunately HTML is not limited to visual markup though. It includes things like the <script> tag, which allow code to be embedded inside the content. When unwanted html appears in user content, that is called HTML Injection. If the code they inject is JavaScript then that is the start of a "Cross Site Scripting" (XSS) attack.

If this code runs on _another_ users browser (no code runs on the server), then the attacker may be able to get information from them, or their computer in a way that the programmer did not expect, or intend.

In short, "cosmetics good, code bad."

For builds of NetTalk before 6.40 it was the responsibility of the developer (you) to make sure that anywhere you ticked on "allow xHtml", you checked that the xHtml you were displaying was "safe". However that's hard to do.

Scrubbing html of code is tricky because there are a large number of vectors that can be used. the <script> tag is not hard to remove, but it's the tip of the iceberg. So, to make it a bit easier, and ultimately more secure, from build 6.40, NetTalk has automatic scrubbing built in.

NetTalk uses a whitelist approach, accepting html it specifically recognizes as valid, and rejecting unrecognized html. This makes it more secure (because "new attacks" generally fall into the "unrecognized" camp.) The alternative (searching for specific bad code) may require updating regularly as new attack vectors are discovered.

In other words, some perfectly legitimate html tags are "blanket excluded" simply because they allow the user too much power. The legal tags excluded in this way are;

Excluded (by design):
base, body, button, canvas, comments, command, datalist, embed, eventsource, frameset, frame, form, head, html, iframe, input, keygen, link, menu, meta, nav, object, optgroup, option, param, script, select, style & textarea

In other words, content stored in your database, which will be displayed via a browse or form or whatever, will not be allowed to contain these tags.

Let me be 100% clear here. This does not affect the xHTML tab (where you can enter your own custom xHtml). It does not affect the html being generated by the templates. It only applies to html which is being read from the database - ie those places where you have explicitly ticked on "Allow xHTML".

The downside with this approach is that some "legitimate" HTML is not allowed. For example, the Hyperlinks example has a browse (BrowseMedia) which included HTML  (youtube videos) containing <iframe> and <object>. Since those are both on the "not allowed" list, they are (by default) no longer playable. This may affect your application if you currently have very rich HTML content stored in your database.

So an extra switch has been added to the template wherever an "Allow xHTML" option is located, there's now also an option to "Allow UNSAFE xHtml". This puts the onus back on you to scrub the HTML in an appropriate way.
But wait, there's more...

You may want to change the list of tags that are allowed, either by adding more allowable tags, or by disallowing some tags which are allowed by default. In this way you can adjust the level of safety, without having to go to a completely unsafe mode. To do this you can embed code in the .TagOk method in the WebServer procedure. for example;

case lower(p_tag)
of 'object'
  return true

Embedding this before the parent call, would make the <object> tag allowable.

As always, security remains a process, not a destination, so remaining up to date (or reasonably up to date) with NetTalk builds is always recommended.
Niels Larsen
Full Member
Posts: 205

View Profile Email
« Reply #1 on: August 16, 2012, 07:06:28 AM »

I've never thought of that. Nice to have "someone" to do the hard work for you.
Posts: 43

View Profile WWW Email
« Reply #2 on: August 16, 2012, 01:00:15 PM »


This is why we pay Bruce the BIG BUCKS!

Great Post Bruce!  Very informative!


« Last Edit: August 16, 2012, 01:02:24 PM by RayA » Logged
Pages: [1]
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.11 | SMF © 2006-2009, Simple Machines LLC
Joomla Bridge by JoomlaHacks.com
Valid XHTML 1.0! Valid CSS!

Login Form

Welcome Guest.

Lost Password?
No account yet? Register
home contact search contact search