hydrea medikamente diflucan price mercury drug philippines lozol rabatt online youtube venlor rezeptfrei schweiz billig provera symptome rabatt nexium otc aristocort generika hersteller ginseng pille preis myambutol preis clonidine online bestellen deutschland yasmin anticonceptie bestellen unisom online apotheke gУМnstig zestoretic online apotheke augmentin online apotheke buy generic kosten rogaine 5 strength kosten detrol er fluoxetin rabatt online ohne rezept zoloft rabatt online epocrates motrin rabatt online order actos online apotheke registo glucophage price usa propranolol gel kaufen kosten alli afslankpil geriforte rezeptfrei niederlande beconase aqueous rezeptfrei beclometasone norvasc generika tУМrkei vytorin verkauf kaufen billig zantac gyne lotrimin preis uti renagel generika rezeptfrei lithium pillen bestellen kosten rogaine 5 spray kaufen ginseng roter diclofenac online apotheke prescription clozaril pille online serophene generika kaufen flagyl er rabatt online buy pariet generika indien reisen periactin rabatt online syrup kaufen billig viagra original colospa rezeptfrei usa kaufen fml forte prospecto slim tea generika erfahrungen diclofenac online apotheke gel buy flexisyn rabatt online apotheke myambutol online bestellen nederland zithromax online apotheke fast shipping suprax rabatt online rabatt cardura zamiennik diovan online apotheke prescription ciplox rezeptfrei niederlande calcium carbonate verkauf solubility in water voltaren tabletten rezeptfrei preis caverta generika indien youtube billig liv 52 or milk thistle allegra online bestellen schweiz shatavari online apotheke paroxetine online apotheke deutschland minocycline medikamente liste periactin rabatt online order calcium carbonate medikamente where to buy rabatt ayurslim renagel online apotheke schweiz allegra online apotheke canada tulasi rabatt online free billig lady era maschio clomid preis apotheke bupropion sr preis sandoz amoxicillin online apotheke liquid unisom kaufen saw palmetto verkauf ultra ginseng pille take bupropion sr verkauf you gain weight stromectol online bestellen buy clindamycin online bestellen xenos lipitor rezeptfrei wo kosten maxalt bestellen aspirin preisvergleich angebote cialis rezeptfrei in tschechien kaufen zofran online apotheke buy dissolvable zovirax durchschnittliche kosten qm zithromax online apotheke buy doxazosin preis qm bupropion sr rezeptfrei benefits big appeal rezeptfrei cream lasix online apotheke get rabatt eulexin manufacturer rogaine 2 pille lotion reviews minocin generika tulsi extrakt kaufen liv 52 bestellen wirkstoff pletal rabatt online order orlistat online bestellen to buy calcium carbonate medikamente zУЄhne periactin medikamente ginseng rabatt online comprar kosten liv 52 walmart glycomet generika tabelle reminyl generikum requip preisvergleich yokebe billig saw palmetto raises estrogen zebeta rezeptfrei schweiz amitriptylin pille mycelex-g rabatt online h&m antabuse rezeptfrei online stromectol durchschnittliche kosten lebensmittel gyne lotrimin preis que sirve kamagra 100mg preis paxil online apotheke prescription preis cialis in spanien keppra durchschnittliche kosten preis ginseng generika suche levitra verkaufen shatavari online apotheke gУМnstig serophene online bestellen clomid fml forte pille prescribing information ayurslim online apotheke yokebe xenical generika kaufen anafranil rezeptfrei niederlande dapoxetine online bestellen espaУБa saw palmetto verkauf hair roxithromycin generika liste thulasi rabatt online watch motilium bestellen imdur generika indien himalaya geriforte kaufen rogaine 5 generika nizoral 2 ketoconazole rabatt seroflo advair zofran odt price walmart kaufen bupropion sr quit smoking cialis kaufen nachnahme tulasi rezeptfrei deutschland imdur online apotheke test ranitidine generika hersteller vantin generika indien youtube kaufen billig zocor online kosten glucophage wirkung rizact generika suche beconase aq rezeptfrei generic name neurontin generika bupropion sr rezeptfrei xl clindamycin online bestellen lotion buy rabatt diovan valsartan vantin generika indien bestellen kaufen gyne lotrimin generic feldene online bestellen order kosten v gel tight billig slim tea you guo azulfidine rezeptfrei usa serophene preis mg tinidazole preis qm ranitidine generika indien china periactin rabatt online h&m effexor piller augmentin online apotheke bestellen amoxicillin online apotheke next day delivery uk viagra rezeptfrei hamburg kaufen billig avodart nebenwirkungen eulexin online bestellen berlin mircette online bestellen vergleich eulexin online bestellen test rabatt trileptal xr rogaine 2 rezeptfrei lУЄnder cialis bestellen nederland grifulvin v bestellen buy saw palmetto verkauf complex zofran online apotheke odt baclofen - ein medikament gegen alkoholsucht kosten rogaine 5 canada endep online apotheke rechnung meclizine generika suche levitra generika 20mg erfahrungen kaufen femara nebenwirkungen tamoxifen online bestellen cheap neurontin generika suche exelon generika liste bupron sr pille price kosten lasix ampullen rabatt pilex iskustva plavix generika kaufen billig calan privat synthroid rezeptfrei test ashwagandha wo kaufen tenormin bestellen purim durchschnittliche kosten lebensmittel phexin durchschnittliche kosten sildalis rabatt online h&m ophthacare generika apotheke bupropion sr pille xl rabatt antabuse uk pristiq durchschnittliche kosten fУМhrerschein adalat rabatt online apnicommunity rabatt etodolac er imitrex rabatt online buying hk actor kaufen purim online bestellen xenos minomycin generika schweiz septilin durchschnittliche kosten lebensmittel viagra pillen preis malegra rezeptfrei insektenstich danabol ds bestellen imuran durchschnittliche kosten implantat casodex preis qm lady era preis un uomo benicar online bestellen ikea finast generika indien cialis kaufen billig cefadroxil elavil durchschnittliche kosten lebensmittel rabatt benfotiamine glycation ginseng kaufen wien billig uv lampe til gelenegle beconase aq rezeptfrei coupon kytril online bestellen wien prandin bestellen kaufen femara premarin online apotheke pharmacy speman generika preisvergleich kosten saw palmetto extract billig rogaine 5 target slim tea online bestellen ovivo cholestoplex durchschnittliche kosten implantat malaria pillen nebenwirkungen proscar online apotheke shop rabatt fml forte jundiai flexisyn rabatt online kaufen calan online bestellen vergleich neurontin generika indien benzac online apotheke bestellen unisom rezeptfrei bestellen abana rezeptfrei italien doxycyclin medikamentenname torasemid online kaufen bupropion sr medikamente for anxiety beconase aq preisvergleich makes medrol online bestellen vergleich nizoral creme kaufen billig rogaine 5 walgreens midamor medikamente liste atorlip-10 rezeptfrei online eulexin online bestellen wien glucovance online apotheke deutschland shatavari root price crestor pillen lithium tabletten bestellen billig liv 52 youtube zantac online bestellen schweiz benicar online bestellen nederland saw palmetto online bestellen gУМnstig vasodilan generika apotheke seroflo preisvergleich yokebe kaufen bupropion sr lose weight bentyl medikamente interaction billig silagra nebenwirkungen aciclovir online bestellen ohne rezept saw palmetto verkauf kullananlar avodart rabatt online prescription nolvadex pille preis clindamycin online bestellen schweiz actos kaufen ginseng generika liste midamor online apotheke juvalis nicotinell kaufen rabatt chloramphenicol yeast zithromax online apotheke mg xalatan rabatt online order kosten atorlip 5 mg cialis kaufen zУМrich amaryl rezeptfrei apotheke motilium online apotheke kaufen kosten liv 52 year round baclofen generika indien youtube effexor rezeptfrei niederlande robaxin pille danach moduretic online bestellen online acticin rabatt online h&m kosten rogaine 2 year results aldara durchschnittliche kosten fУМhrerschein remeron rabatt online apotheke benicar pille prometrium online apotheke niederlande carafate rezeptfrei insektenstich cefadroxil bestellen online cialis kaufen in kroatien accutane verkauf billig liv 52 himalaya products bupropion sr pille versus xl kaufen billig aldactone wirkstoff lioresal pillen calcium carbonate preis common name vasodilan generika gУМnstig rabatt hydrochlorothiazide side elavil durchschnittliche kosten qm ashwagandha online apotheke oil clarins online bestellen schweiz cholestoplex online bestellen gУМnstig preisvergleich nicotinell 52 rogaine 5 preisvergleich bestellen ciprofloxacin kaufen kaufen billig zantac nebenwirkungen billig baclofen hersteller billig saw palmetto nedir arcoxia rabatt online apotheke lipitor price history benicar rezeptfrei schweiz rabatt provera voltaren emulgel preis kaufen billig zyban bupropion benzac online bestellen acquista venlo kein verkauf an deutsche lasix online apotheke buying calcium carbonate medikamente xylitol clindamycin online bestellen rezeptfrei ralista online bestellen nederland cardizem pille online kosten digoxin nebenwirkungen medikament tamoxifen al 20 voveran online bestellen ikea rogaine 5 generika topical foam toprol generika suche bupropion sr pille xl for weight loss yasmin online apotheke ohne rezept geriforte rezeptfrei holland aleve menstruatie pillen septilin rezeptfrei viagra benzac online apotheke gel voltaren dispers n1 preis triamteren hct preis seroquel price walmart tofranil generika indien reisen kosten lithium akku citalopram rabatt online buy rabatt geriforte tablets naltrexone rezeptfrei kosten ginseng kosten glucophage abnehmen nasonex rezeptfrei tadalis online bestellen wien rabatt levitra vs actos online bestellen kosten tegretol nebenwirkungen tulsi online bestellen amrit silvitra rezeptfrei holland beconase aq preisvergleich who makes wellbutrin rezeptfrei holland slimming tea preisvergleich ratu efek samping kosten rogaine 5 liquid olanzapin medikamentengruppe benicar online bestellen test fluoxetine retail price clonidine online bestellen purchase suprax rabatt online coupon voltaren rabatt online schmerzgel online-apotheke azulfidine rezeptfrei frankreich fucidin salbe 2 preisvergleich elavil rezeptfrei gУМnstig trimox rezeptfrei apotheke toprol generika zulassung apcalis online bestellen ikea menosan verkauf online billig lipitor wirkung endep rabatt online easyjet singulair rabatt online mg himcocid generika gУМnstig kemadrin preisvergleich kaufen imuran alkohol lexapro durchschnittliche kosten fУМhrerschein valentin online bestellen filmnУЉzУЉs adalat online apotheke index exelon generika viagra apcalis online bestellen deutschland calcium carbonate medikamente uses billig slim tea spa viagra rezeptfrei ausland rogaine 5 generika hair endep online apotheke homУЖopathie rabatt cialis preis chloroquine pille preis periactin rezeptfrei wo aygestin rezeptfrei holland rabatt nizagara information clonidine online bestellen xxl tadalis generika tУМrkei gyne lotrimin preis walmart arcoxia online bestellen test billig lady era port cartier baclofen price philippines plendil online apotheke gУМnstig bactrim online bestellen nederland lady era preis oscar vantin online bestellen vergleich tadalis online bestellen generika lexapro moduretic generika liste skelaxin generika indien youtube periactin rabatt online free calcium carbonate verkauf vitamin d hytrin rezeptfrei deutschland rogaine 5 preisvergleich instructions calcium carbonate verkauf deutsch confido preis qm levitra generika kaufen schweiz bupron sr preis reviews alesse generika liste kosten nitrofurantoin langzeittherapie strattera generika indien youtube cialis rezeptfrei per rechnung rogaine 2 pille once a day procardia online apotheke buy benicar online bestellen hct entocort online bestellen test aleve rezeptfrei kaufen pletal rabatt online shop rogaine 2 pille works doxazosin online bestellen schweiz baclofen rezeptfrei wien viramune kaufen endep online apotheke gutschein augmentin online bestellen flonase bestellen tamoxifen online apotheke buying voltaren dolo rezeptfrei proscar online apotheke buy speman online bestellen billig bupropion sr quit smoking kaufen billig silagra bestellen emsam preisvergleich flagyl er generika indien reisen femara rabatt online bupropion sr medikamente side effects paroxetine online apotheke prescription aciclovir online bestellen nederland kaufen billig silagra online risperdal rezeptfrei deutschland suprax rabatt online free ditropan generika tУМrkei liv 52 bestellen kaina grifulvin v rezeptfrei tablets side effects lynoral generika deutschland bentyl rabatt online apotheke aristocort generika viagra kaufen billig endep iphone 5 fml forte pille colirio billig bupropion sr get you high medikamente actos clarina online bestellen produkte prilosec rabatt online kaufen actos online apotheke exercicios lozol rabatt online bupropion sr bestellen you lose weight grifulvin v rezeptfrei wo fluoxetine medikamente depression kaufen billig evista nebenwirkungen flonase preis qm xenical dubai price fosamax price uk isoptin online bestellen deutschland bupropion sr bestellen hcl kaufen bupropion sr by sandoz seroquel rezeptfrei apotheke benzac generika preisvergleich lynoral generika viagra voltaren 50 mg zУЄpfchen preis preise levitra generika aldara creme rezeptfrei kaufen rabatt big appeal theory speman generika zoll billig liv 52 for dogs zestoretic preise eldepryl online bestellen buy lipitor rezeptfrei niederlande strattera price without insurance gasex online apotheke preisvergleich seroflo rezeptfrei niederlande zyban nhs price actonel generika deutschland preis casodex preisvergleich rogaine 5 medikamente hair loss maxalt generika kaufen billig zyban kosten aciclovir preisvergleich mg billig aciclovir nebenwirkungen kaufen billig zyban online betapace rezeptfrei lУЄnder panmycin generika hersteller dulcolax dragees bestellen exelon patch preis benfotiamine pille danach indinavir rezeptfrei wien endep online apotheke berlin rogaine 2 rabatt online h&m colchicine online apotheke juvalis lipitor rezeptfrei lotrisone rezeptfrei kaufen ashwagandha kaufen berlin kaufen gyne lotrimin in stores hytrin generika tУМrkei ciplox pille sinemet rezeptfrei lamictal rabatt online for sale
Home Forum Download/Upload Links Search

NetTalk User Group

NetTalk User Group Meeting!
Live Webinar!
Saturday Nov. 16 
7am PST
Click Here To Register!
Home arrow Forum arrow NetTalk Web Serverarrow Web Server - Share Knowledgearrow Security: HTML Injection / XSS attacks.
NetTalk Central
February 10, 2016, 12:35:48 AM *
Welcome, Guest. Please login or register.

Login with username, password and session length
News: Welcome to the NetTalk Central Forums!
 
   Home   Help Search Login Register  
Pages: [1]
  Print  
Author Topic: Security: HTML Injection / XSS attacks.  (Read 2719 times)
Bruce
Global Moderator
Hero Member
*****
Posts: 7965



View Profile
« on: August 16, 2012, 02:01:09 AM »

HTML Injection is a security issue which occurs when you let users enter "html" content. So, for example, if you have a text control on a form, and Allow xHTML is on, then you're allowing the user to enter HTML and content, and then you will display that content using their HTML markup.

Unfortunately HTML is not limited to visual markup though. It includes things like the <script> tag, which allow code to be embedded inside the content. When unwanted html appears in user content, that is called HTML Injection. If the code they inject is JavaScript then that is the start of a "Cross Site Scripting" (XSS) attack.

If this code runs on _another_ users browser (no code runs on the server), then the attacker may be able to get information from them, or their computer in a way that the programmer did not expect, or intend.

In short, "cosmetics good, code bad."

For builds of NetTalk before 6.40 it was the responsibility of the developer (you) to make sure that anywhere you ticked on "allow xHtml", you checked that the xHtml you were displaying was "safe". However that's hard to do.

Scrubbing html of code is tricky because there are a large number of vectors that can be used. the <script> tag is not hard to remove, but it's the tip of the iceberg. So, to make it a bit easier, and ultimately more secure, from build 6.40, NetTalk has automatic scrubbing built in.

NetTalk uses a whitelist approach, accepting html it specifically recognizes as valid, and rejecting unrecognized html. This makes it more secure (because "new attacks" generally fall into the "unrecognized" camp.) The alternative (searching for specific bad code) may require updating regularly as new attack vectors are discovered.

In other words, some perfectly legitimate html tags are "blanket excluded" simply because they allow the user too much power. The legal tags excluded in this way are;

Excluded (by design):
base, body, button, canvas, comments, command, datalist, embed, eventsource, frameset, frame, form, head, html, iframe, input, keygen, link, menu, meta, nav, object, optgroup, option, param, script, select, style & textarea

In other words, content stored in your database, which will be displayed via a browse or form or whatever, will not be allowed to contain these tags.

Let me be 100% clear here. This does not affect the xHTML tab (where you can enter your own custom xHtml). It does not affect the html being generated by the templates. It only applies to html which is being read from the database - ie those places where you have explicitly ticked on "Allow xHTML".

The downside with this approach is that some "legitimate" HTML is not allowed. For example, the Hyperlinks example has a browse (BrowseMedia) which included HTML  (youtube videos) containing <iframe> and <object>. Since those are both on the "not allowed" list, they are (by default) no longer playable. This may affect your application if you currently have very rich HTML content stored in your database.

So an extra switch has been added to the template wherever an "Allow xHTML" option is located, there's now also an option to "Allow UNSAFE xHtml". This puts the onus back on you to scrub the HTML in an appropriate way.
But wait, there's more...

You may want to change the list of tags that are allowed, either by adding more allowable tags, or by disallowing some tags which are allowed by default. In this way you can adjust the level of safety, without having to go to a completely unsafe mode. To do this you can embed code in the .TagOk method in the WebServer procedure. for example;

case lower(p_tag)
of 'object'
  return true
end


Embedding this before the parent call, would make the <object> tag allowable.

As always, security remains a process, not a destination, so remaining up to date (or reasonably up to date) with NetTalk builds is always recommended.
Logged
Niels Larsen
Full Member
***
Posts: 214


View Profile Email
« Reply #1 on: August 16, 2012, 07:06:28 AM »

I've never thought of that. Nice to have "someone" to do the hard work for you.
Thanks!!
Logged
RayA
Newbie
*
Posts: 43


View Profile WWW Email
« Reply #2 on: August 16, 2012, 01:00:15 PM »

 Grin

This is why we pay Bruce the BIG BUCKS!

Great Post Bruce!  Very informative!

 Grin

« Last Edit: August 16, 2012, 01:02:24 PM by RayA » Logged
Pages: [1]
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.11 | SMF © 2006-2009, Simple Machines LLC
Joomla Bridge by JoomlaHacks.com
Valid XHTML 1.0! Valid CSS!

Login Form

Welcome Guest.






Lost Password?
No account yet? Register
home contact search contact search