zoloft online sale cheap viagra st cialis pro generic esomeprazole nexium buy cialis half 20mg viagra 50 mg sildenafil celebrex online purchase buy viagra bahamas diflucan 50 mg kapszula difference viagra 100 50 mg augmentin prospect 500 mg strattera mgs cheap viagra bulk nyc buy viagra cialis 5mg brand lexapro cheap price buy periactin london generic viagra since zoloft 600mg online cialis mexico cialis generic quality lexapro generico colombia brand cialis 10 mg propecia canada generic xenical 120 mg opinioni cialis 5mg valor 20mg cialis dafe buy viagra removethis buy authentic priligy generic wellbutrin complaints get online viagra augmentin 1 mg pret online cytotec cheapest cialis 2.5 mg 360 generic propecia 5mg cipro 500mg vo propranolol 80 mg capsules lexapro 10mg overdose nexium 40 mg fiale doxycycline buy online prednisone 10mg tablets buying 40 mg cialis online parm viagra viagra wieviel mg wellbutrin generic pills celebrex 200 mg bid 160 mg propranolol lisinopril 10 mg prices buy lasix 12.5 mg diflucan 150 online order zithromax 500mg levitra 2 mg experience viagra online propecia generico ecuador doxycycline 200 mg daily buy viagra ahmedabad 250mg of viagra clomid 50 mg indicazioni cipro order online doxycycline 100mg mekophar nombre generico propranolol buy 100 mg strattera diflucan 500 mg generique cialis 2.5mg tetracycline dosage 500 mg illegal generic viagra buy triamterene hydrochlorothiazide prospecto levitra 5 mg nexium 20mg 28 comprimidos lexapro 15 mg buy amoxil dosage 250 mg generic zoloft diarrhea priligy 30 o 60 mg prednisone online cialis 10 mg online priligy 60mg buy 10 tabs viagra generic viagra 500mg cheap viagra malaysia finasteride propecia cheap doxycycline 100mg indication safe cheap levitra metformin hcl 1500 mg generic propecia wiki celebrex 100mg nebenwirkungen viagra 100 mg nehmen metformin online purchase wellbutrin generic appearance buy clomid europe doxycycline liquid 100 mg lexapro tabletas 10 mg buy lasix priligy generico portugal 50mg viagra online cipro hcl 500 mg kamagra 1000 mg clomid 50 mg prijs zithromax order online doxycycline 100 mg chlamydia viagra super cheap price 20 mg levitra celebrex generic when cialis jg 100 mg strattera 60 mg preis cialis 100mg wholesale buy xenical miami viagra online kwik provato viagra generico cheapest 150mg viagra glaxosmithkline amoxil 500 mg canada cialis 200 mg cheap dapoxetine online zithromax 500mg uk nexium 20 mg cijena buy clomid women cialis 5mg serve super cheap cialis cialis 100 mg uae kamagra fizz 100 mg propranolol tab 40 mg kamagra 100mg testbericht lexapro 20mg alcohol strattera 100 mg dosage valtrex tablets 500 mg zithromax buy singapore clomid 50 mg indication viagra 500mg uk 5mg lisinopril diuretic buy generic cytotec bactrim online order headache cialis 100 mg levitra 20 mg torrinomedica vanzari online clomid nexium 40mg for cialis online mastercard buspar 10 mg prospecto cialis generique 20mg remedio zoloft 50 mg ems generico viagra doxycycline gel online buy lexapro 10 generic viagra google cialis 5 mg hinnoittelu citalopram 20 mg prednisone 10 mg pills viagra 50mg 4 pack jelly kamagra 100 mg amoxil 200mg online viagra 150 mg 50mg viagra review viagra onlinecvs nolvadex sale 20 mg generico viagra pramil order celebrex 200mg cialis online inghilterra generic lisinopril 2.5 mg cialis tadafil 20mg lasix 80mg buy cialis stuttgart glucophage generic cialis 5mg quanos delivery cialis 5 mg uk generic propecia cipro 500 mg precio augmentin tabletta 625 mg cialis 5 mg dubai buy nolvadex 10 mg commander cialis 20mg dosage nexium 40 mg canadian viagra buy buy inject lasix nexium cheapest clomid 100mg effective buy nolvadex review cheapest kamagra jel cialis online shop xenical 120 mg dosierung propecia finasteride 0.5mg levitra 20 mg argentina ordering zithromax lisinopril buy cheap viagra disputes nolvadex de 10 mg generic lisinopril g 101 cialis 40 mg better viagra online shanghai 850 mg metformin ttc generic of zoloft viagra 100mg de order mexican viagra lisinopril 10 mg coupon viagra 50 mg vs 100 viagra 50 mg 4 comprimidos hydrochlorothiazide 25 mg espanol cheap kamagra usa clomid multiples 50mg viagra vs. generic zovirax comprar online viagra get buying 4000 mg metformin cialis de 30 mg nexium for cheap 1500 mg augmentin lisinopril 5 mg cena zithromax 500mg tripak buy doxycycline fish order valtrex uk buy viagra canada doxycycline buy prednisone 80mg asthma buy weekend viagra viagra sales online viagra online pills viagra buy melbourne lisinopril buy usa safe generic levitra 2.5mg viagra 3 mg of prednisone legit viagra online levitra 5mg erfahrungsberichte propranolol 10 mg ulotka propecia generic price celebrex generic release cheap cialis find to buy levitra erfahrung viagra 100mg nolvadex 10mg dosage wellbutrin rx online buy doxycycline online buy viagra online help buying lexapro viagra 150mg. kamagra london buy buying strattera canada non generic levitra cipro online prescription 10 mg of lisinopril online sale zovirax propranolol mg dosage cialis 2.5 mg packstation 3000 mg valtrex cialis na ebuy kamagra 100 mg tabletki cialis 5 mg daglig tetracycline 500mg dosage telmisartan hydrochlorothiazide generic generic viagra 100 white doxycycline capsules online online cialis order phenergan 250 mg levitra 20 mg brand generic of lexapro erythromycin iv backorder generic viagra drug buy generic clomid viagra 100mg directions celebrex mg dosage celebrex generic otc lexapro overdose 40mg lasix 500mg pret doxycycline 100mg fish viagra 50 mg buy buying viagra leeds 30mg of levitra generic of buspar levitra 20 mg paypal online lexapro pharmacy strattera 80 mgs 500 mg of augmentin doxycycline hyclate 100mg kamagra 100mgoral jelly contraindicaciones levitra 10 mg lisinopril 10 mg color zoloft 25 mg dosage buy cialis black cialis 100m online buy viagra kentucky buy zovirax acyclovir viagra 50 mg durata generique cialis 40mg anxiety buspar disorder generic viagra companies lexapro 40 mg withdrawal wellbutrin dosage 450 mg levitra cheap uk lisinopril 40mg price nexium have generic lisinopril generic costco generic cialis overseas buy kamagra pound cialis generico europa buy legitimate viagra tetracycline order buy zovirax ireland wellbutrin generic recall 2012 purple nexium 40 mg nexium 20mg boots generic propecia legal bijwerkingen clomid 100 mg phenergan 200mg walgreens wellbutrin generic 500mg of valtrex kamagra 150 mg information reliable cialis online cialis 10 mg vendita kegunaan glucophage 500 mg viagra online kupnja 75 mg wellbutrin lexapro 15 mg 20 mg lisinopril 10 mg names does generic propecia starting 20mg lexapro bijsluiter nexium 10 mg fungsi cialis 20mg viagra buy wiki zovirax tabletas 400 mg cialis online warnings lasix 500mg pharmacy 100 mg of strattera viagra 3800mg super kamagra 150mg cialis 20 mg preiswert obat cialis 80 mg cialis uk online online propranolol cialis 10mg singapore superovulation 25mg clomid cialis two 10mg obat celebrex 400mg 500 hcl metformin mg generic lexapro 2012 march nexium otc generic augmentin 500 mg tablet green kamagra online online viagra baby amoxil 500mg indications cheap levitra 5 mg prednisone 50 mg posologie propecia generics cialis 60 mg online propecia buy now matrix 120 mg viagra beat generic levitra celebrex online store prednisone liver disorders viagra online romania periactin 4mg tablets 100 order lasix us lisinopril 40 mg w 942 ciple viagra online bactrim 400 80 mg generic levitra thailand yasmin glucophage 500mg zoloft order prozac zithromax india online teva generic lexapro 2012 buy cialis pill cialis australia generic 1500 mg glucophage cialis 20 mg docpharm lisinopril generic prices viagra fiyati 50 mg amoxil 500 mg glaxosmithkline doxycycline 25mg francais generico nexium 40 mg genuine cialis buy buying periactin online cialis 5mg niederlande doxycycline 50mg dogs generic viagra cialis online viagra source generic cialis 60 mg augmentin 500 mg uses lisinopril 30 mg dosage 60 mg generic cialis xenical caps .120 mg celebrex 200mg notice took 600 mg wellbutrin 5 mg zoloft nexium 40 mg infarmed cialis generic trial took 40 mg lexapro buying clomid 150mg comprar cialis 25mg generic substitutes celebrex kamagra 100 mg wikipedia strattera online sales synthroid generic medicine online viagra support thuoc zithromax 250mg starting clomid 50 mg buy cialis india viagra 100mg prix levitra 400mg 1.19 generic viagra 130 mg clomid 10 mg viagra switzerland online Levitra 120 pills Buy cheap levitra 100 buying viagra abroad augmentin 62 5mg lisinopril what mg hydrochlorothiazide 25 mg costs lisinopril 20 mg safe cialis cheapsarasotafl metformin 500 mg dosierung propranolol 10 mg uses propecia online paypal viagra instructions 50 mg nolvadex 40mg price zoloft 60 mg viagra 12.5 mg sandoz prix diflucan 150 mg prednisone 10mg westward propranolol 320 mg 200 mg doxycycline gum generic zoloft overdose wellbutrin 200 mg sr cialis 5 mg tabletta generic overnight viagra prednisone 10 mg 54 899 propranolol 160 mg dosage buy viagra pattaya 2012 periactin tablets buy buying clomid 150 mg viagra 3000mg levitra generico professional cialis prijs 5mg buy nexium china cipro 500 mg tablets viagra online legitimate cheapest cialis 10mg lexapro 10mg 28 comprimidos cheap super kamagra seized generic viagra propranolol clorhidrato generico erythromycin ec 333 mg levitra 10mg rezeptfrei indonesia cheap viagra viagra generic brasil levitra price 20 mg buspar 10 10 mg 30 comprimidos controindicazioni xenical 120 mg valtrex 500 mg uses viagra 100mg wikipedia celebrex 100 mg image prednisone 20 mg daily generic wellbutrin heartburn viagra red 200 mg orlistat generic alli hydrochlorothiazide 25 mg edema buy cialis discreetly zithromax online prescription buy viagra cork celebrex 200 mg capsule 40mg levitra dosage order levitra prescription buy viagra 150 mg cialis becoming generic augmentin 156 mg pret cialis 10 mg efectos preisvergleich cialis 10 mg buyers generic viagra brand viagra 50mg prednisone 5mg side dosage prednisone 5mg online canada cialis generic cialis tadacip erythromycin ointment buy zoloft generic costco viagra 50 mg erfahrungsberichte zithromax 250 mg generic cgv cheap viagra cialis 5 mg foros generic for nolvadex cheap lasix 40mg nexium cost makers generic metformin cheapest wellbutrin online cialis 5 mg take 2 wellbutrin 100 mg sa viagra buy bali prix cialis 5mg augmentin 400 mg suspension celebrex go generic cvc cialis 5mg generic viagra bangalore doxycycline 100mg leptospirosis propranolol dak 10 mg buy cialis 200 mg tomei viagra 100mg levitra 100mg facts periactin mg 20 mg bayer levitra cheap propecia au lexapro buying online cialis 100 mg 20mg wellbutrin generic anxiety doxycycline 50 mg chlamydia 120mg generic viagra
Home Forum Download/Upload Links Search

NetTalk User Group

NetTalk User Group Meeting!
Live Webinar!
Saturday Nov. 16 
7am PST
Click Here To Register!
Home arrow Forum arrow NetTalk Web Serverarrow Web Server - Share Knowledgearrow Security: HTML Injection / XSS attacks.
NetTalk Central
July 06, 2015, 06:44:45 PM *
Welcome, Guest. Please login or register.

Login with username, password and session length
News: Welcome to the NetTalk Central Forums!
 
   Home   Help Search Login Register  
Pages: [1]
  Print  
Author Topic: Security: HTML Injection / XSS attacks.  (Read 2359 times)
Bruce
Global Moderator
Hero Member
*****
Posts: 7586



View Profile
« on: August 16, 2012, 02:01:09 AM »

HTML Injection is a security issue which occurs when you let users enter "html" content. So, for example, if you have a text control on a form, and Allow xHTML is on, then you're allowing the user to enter HTML and content, and then you will display that content using their HTML markup.

Unfortunately HTML is not limited to visual markup though. It includes things like the <script> tag, which allow code to be embedded inside the content. When unwanted html appears in user content, that is called HTML Injection. If the code they inject is JavaScript then that is the start of a "Cross Site Scripting" (XSS) attack.

If this code runs on _another_ users browser (no code runs on the server), then the attacker may be able to get information from them, or their computer in a way that the programmer did not expect, or intend.

In short, "cosmetics good, code bad."

For builds of NetTalk before 6.40 it was the responsibility of the developer (you) to make sure that anywhere you ticked on "allow xHtml", you checked that the xHtml you were displaying was "safe". However that's hard to do.

Scrubbing html of code is tricky because there are a large number of vectors that can be used. the <script> tag is not hard to remove, but it's the tip of the iceberg. So, to make it a bit easier, and ultimately more secure, from build 6.40, NetTalk has automatic scrubbing built in.

NetTalk uses a whitelist approach, accepting html it specifically recognizes as valid, and rejecting unrecognized html. This makes it more secure (because "new attacks" generally fall into the "unrecognized" camp.) The alternative (searching for specific bad code) may require updating regularly as new attack vectors are discovered.

In other words, some perfectly legitimate html tags are "blanket excluded" simply because they allow the user too much power. The legal tags excluded in this way are;

Excluded (by design):
base, body, button, canvas, comments, command, datalist, embed, eventsource, frameset, frame, form, head, html, iframe, input, keygen, link, menu, meta, nav, object, optgroup, option, param, script, select, style & textarea

In other words, content stored in your database, which will be displayed via a browse or form or whatever, will not be allowed to contain these tags.

Let me be 100% clear here. This does not affect the xHTML tab (where you can enter your own custom xHtml). It does not affect the html being generated by the templates. It only applies to html which is being read from the database - ie those places where you have explicitly ticked on "Allow xHTML".

The downside with this approach is that some "legitimate" HTML is not allowed. For example, the Hyperlinks example has a browse (BrowseMedia) which included HTML  (youtube videos) containing <iframe> and <object>. Since those are both on the "not allowed" list, they are (by default) no longer playable. This may affect your application if you currently have very rich HTML content stored in your database.

So an extra switch has been added to the template wherever an "Allow xHTML" option is located, there's now also an option to "Allow UNSAFE xHtml". This puts the onus back on you to scrub the HTML in an appropriate way.
But wait, there's more...

You may want to change the list of tags that are allowed, either by adding more allowable tags, or by disallowing some tags which are allowed by default. In this way you can adjust the level of safety, without having to go to a completely unsafe mode. To do this you can embed code in the .TagOk method in the WebServer procedure. for example;

case lower(p_tag)
of 'object'
  return true
end


Embedding this before the parent call, would make the <object> tag allowable.

As always, security remains a process, not a destination, so remaining up to date (or reasonably up to date) with NetTalk builds is always recommended.
Logged
Niels Larsen
Full Member
***
Posts: 198


View Profile Email
« Reply #1 on: August 16, 2012, 07:06:28 AM »

I've never thought of that. Nice to have "someone" to do the hard work for you.
Thanks!!
Logged
RayA
Newbie
*
Posts: 43


View Profile WWW Email
« Reply #2 on: August 16, 2012, 01:00:15 PM »

 Grin

This is why we pay Bruce the BIG BUCKS!

Great Post Bruce!  Very informative!

 Grin

« Last Edit: August 16, 2012, 01:02:24 PM by RayA » Logged
Pages: [1]
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.11 | SMF © 2006-2009, Simple Machines LLC
Joomla Bridge by JoomlaHacks.com
Valid XHTML 1.0! Valid CSS!

Login Form

Welcome Guest.






Lost Password?
No account yet? Register
home contact search contact search