strattera generic brand nolvadex cheap propecia available generic cialis prices 10 mg clomid 50 mg compresse medicine metformin 500 mg 5 mg cialis cipro xr cheap precio xenical generico phenergan suppositories 25 mg nakup viagra 25 mg propecia brand buy buy diflucan singapore viagra order online cialis 20 or 10mg cialis 20mg overdose celebrex 200 mg capsules viagra 5800mg cialis online forums contraindicaciones cialis 20 mg zoloft menstrual disorder cheap gerne cialis buy clomid england buy pct clomid bula xenical 120mg nolvadex 10mg price order propecia strattera 90 mg clomid 50mg eggs generic cialis country celebrex capsulas 100 mg clomid 150 mg online lisinopril de 5mg hydrochlorothiazide 25 mg tab cialis 5mg daily generic doxycycline hyclatetwo 5mg levitra metformin 500 mg heumann potenzmittel cialis 10mg 20mg liquid cialis cialis 10mg prices lexapro mg dose online viagra satis propranolol 80 mg angst purchase celebrex online azithromycin zithromax 400 mg cialis 5 mg opinie viagra 25mg erfahrung generics for wellbutrin propecia online philippine cialis 20 mg online cialis 5mg prodaja kamagra 100mg prodaja clomid 50mg dubai emivita cialis 5 mg cialis 5 mg benefici augmentin compresse 125 mg zoloft online canada propranolol bula 40mg thuoc lasix 20mg hydrochlorothiazide 25 mg ingredients 15 20 mg lexapro hydrochlorothiazide usp 25 mg augmentin 500 mg tb buspar 15 mg bid generic med wellbutrin esomeprazole generic nexium buy cytotec baguio 40mg levitra celebrex 400 mg levitra filmtabletten 10 mg lexapro 5 mg review viagra generica greece about augmentin 625mg tomar cialis 10 mg buy cialis fioricet viagra online questionnaire online propecia discounts wellbutrin generic anchen viagra natural online zoloft overdose 500 mg lasix 50mg indication small viagra order cipro 250mg dosage buy viagra boots xenical buy free celebrex 200 mg contraindicaciones lisinopril 40 mg pill viagra online voucher cialis 5 eller 10 mg citalopram 10 mg nexium buy cheap strattera 40 mg tratamiento prednisone 25 mg tablets generic viagra taiwan pro metformin 500 mg buy viagra mumbai kegunaan doxycycline 100mg cipro generic dosage cialis 2 5mg online bupropion generic wellbutrin nolvadex uk 10mg baku viagra online lexapro 5 mg tiredeness metformin 500mg bula buy viagra 2 days 100mg viagra paypal generic cialis 10 mg. cialis brand 40 mg strattera cheap buy prednisone canada 100 mg wellbutrin sr buy doxycycline toronto online chat viagra medicamento cialis 40 mg 5 cialis generico sildenafil dosierung levitra 20mg viagra generic legit buy viagra beijing generic lexapro ineffective generic viagra usaa 0.25mg propecia 2012 lisinopril 2.5 mg e25 comprar levitra 5 mg clomid 100mg buy valtrex 500mg kosten review cialis 2.5mg viagra order individually buy strattera 60mg zithromax 500 mg dose nexium 50 mg zithromax 500 mg sport thuoc erythromycin 500mg metformin 125 mg buy cialis malta clomid 50mg online teva 20 mg lexapro generic lexapro list cialis 20mg danger generic viagra overseas 0.025mg synthroid buy singapore viagra good generic nexium zithromax online buy buy celebrex uk generic lexapro 5 1 mg propecia wellbutrin 450mg ordering generic levitra cialis 10 mg canada viagra cheap pills cheapest cialis daily generic lexapro 10 mg espillses buy cialis prezzo cialis 10 mg medikament levitra 20mg starting zoloft 100mg zithromax australlia online cipro 500 mg siprofloksasin metformin actavis 500mg order nexium europe viagra generico prezzi lexapro 20 mg canada reimport cialis 20mg cialis diario 2 5 mg buy lexapro walmart 50mg doxycycline arthritis generic lexapro dizzy doxycycline 100mg generic prezzo cialis 5 mg generic viagra arizona augmentin 250 mgs levitra oro 20 mg viagra generic safe viagra online comprar 5 mg generic cialis metformin 500 mg composition nexium 10 mg pret generic viagra report thuoc metformin 850 mg propecia results 5mg lisinopril tab 2.5 mg glucophage 500 mg dosage bijsluiter propranolol 40 mg propranolol 60 mg generic japan viagra medco order cialis viagra cheap uk xenical buy kegunaan clomid 50mg generic viagra breathing viagra cialis generica propranolol 20 mg ansiedade posologie diflucan 200mg chepest 800 mg viagra viagra 50 mg anwendung levitra purchase generic cheap 100 mg clomid cheapest cialis drug diflucan 150 mg vidal cialis 2omg daily cipro 500mg pregnancy brand cialis 20 mg tetracycline hcl 500 mg 40 mg levitra levitra 20mg dzialanie viagra xenical 120 online valtrex generic medication nexium 20 mg uses cipro online online prescription lisinopril lexapro and generics kamagra 100mg posologie cheap viagra genuine generic lexapro 2012 canada urdu clomid 50 mg zithromax syrup 100 mg lisinopril 5 mg drug viagra generic pfizer mg of valtrex kamagra buy london cheapest 5 mg cialis diflucan 350 mg propranolol 80 mg retard priligy 30mg lloyds bactrim 800 mg uti bactrim generic dosage cialis cheap price cialis online fiable metformin axcount 500mg augmentin 500 mg dosis taking 400 mg viagra cialis tablets cheap lasix cheap online synthroid 50 mg emagrece bactrim 500 mg suspencion viagra 25 mg france manufacturers kamagra 100 mg cialis 5 mg occasionalmente doxycycline hyclate 100 mg cialis daily online buy cialis safely propecia da 05 mg blue lisinopril 10 mg generic cialis viagra zithromax 500 mg preis lexapro 30 mg depression amoxil 400mg bula 5mg cialis .ca strattera 60 mg fiyat cheapest propecia generic cheapest augmentin online celebrex buy tetracycline online pharmacy lisinopril tablet 10mg viagra onlineperth bactrim vs generic metformin tab 850 mg metformin mg dosage celebrex dosage 200mg lexapro 20 mg about mg of buspar augmentin 875 125mg lisinopril tabs 5mg clomid online 150 prednisone 60 mg asthma prednisone 10mg rash valtrex 500 mg fiyati buy amoxil dogs order 2.5 mg cialis mg diflucan buy nolvadex sustanon amoxil 875 mg bd reputable viagra online cialis 14 tb 5mg obat cialis 10 mg celebrex dosage 400 mg generic valtrex 1000mg buy propranolol europe online levitra mastercard prednisone 5mg inida lisinopril 2.5 mg pregnancy zovirax 80 mg generic viagra information buy priligy malaysia 40mg cialis online ic propranolol 10 mg acyclovir zovirax 800 mg generic lexapro 2012 walmart levitra generic 10 mg 6online prescription propecia cialis 5 mg yorumlar buy diflucan oral generic zoloft canada augmentin 200mg generic zoloft cost glucophage xr buy flagyl er online celebrex 100mg capsule zithromax online 2013 doxycycline 50mg tablets viagra pills generic lexapro 10 mg generic mastercard cialis online cialis buyer mg viagra 325lb cialis 20mg dangers erythromycin 250mg mekophar prednisone 50mg discount 5 mg cialis doxycycline monohydrate 40mg online viagra sell cialis 30 5 mg kamagra order uk buy viagra phizer buying lexapro online cheapest viagra forum cialis generic review viagra online hk cialis coupons 20 mg clomid uk online cialis superactive 100 mg pill nexium 40mg generic nexium availability priligy online sales prednisone 80mg priligy buy canada lasix furosemide 20mg buy viagra alternatives cialis 5 mg filmtabletten cialis 5mgm prices strattera price 40mg valtrex 500mg filmtabletten cialis online wiki doxycycline 100mg reviews 15mg cialis dosage zithromax generic 500mg diflucan 400 mg pret propecia generic name levitra 20 mg foro generic wellbutrin problems 2011 generic viagra 150 mgs cipro uti 500 mg prednisone 50 mgs celebrex mg 200 cialis forum mg doxycycline hyc 100mg doxycycline 20 mg reviews generic lexapro release cheap clomid uk foro levitra 10 mg buy levitra online 7 celebrex 200 mg presentacion sample levitra 20 mg nolvadex 50mg cheap womens viagra viagra 300 mg propecia uk buy 150mg dosage viagra bactrim generic form generic cialis ray buying viagra advice nebenwirkungen propranolol 10 mg test generic cialis cialis 20mg nz xenical online bestellen nexium tablets 40mg xenical 200 mg bilgi buy clomid bangalore cialis legitimate cheaper lisinopril generic price cialis 20mg 8 500mg of zithromax order zithromax powder strattera 80 mg dosage doxycycline doxin 100mg cheap uk nolvadex buy stockholm viagra bronchitis prednisone 5mg generis levitra 40 mg metformin hcl 250 mg buy nolvadex supplement diflucan 100 mg uses erythromycin base 500 mg precio lexapro 20 mg strattera 40 mg used cipla generic cialis .50 300 acquisto xenical 120 mg price prednisone 20 mg lexapro 10 mg prices augmentin dosage 625 mg cheap english viagra cialis 40mg safe malaysia cheap viagra priligy ftbl 30 mg buy avian doxycycline cialis dose 100 mg diflucan pill 150 mg cadastro nexium 40mg cialis lastschriftverfahren online purchase generic valtrex cipro 250 mg tb medicamento priligy 60 mg propecia online real viagra to order levitra 10 mg kaufen cialis vs generics generic dapoxetine kamagra 25mg results comprimes levitra 20mg diflucan 150 mg prescription viagra 50 mg 25 mg clomid testosteron viagra online illegale buy viagra ottawa hydrochlorothiazide actavis 25 mg xenical online singapore glucophage 850 mg price levitra generico uk brazil generic viagra clomid generic manufacturers metformin 500 mg description lexapro 20 mg efectos 100 mg clomid results 500mg metformin er buy xenical pills viagra jet 50 mg is propecia generic buy celebrex us augmentin 1g 125 mg 150 mg viagra ok cheapest viagra sildenafil levitra professional cheap dosis augmentin 500mg cialis generic dosing buying cialis 10mg lexapro 50 mg ulotka 20mg cialis review viagra mexico 100mg sublingual viagra 100mg amoxil 500 mg presentacion hungary buy cialis viagra generic hersteller review xenical 120mg cipro tablete 500mg vente cialis 20mg viagra.nl online buy viagra fourm buy nolvadex 10mg 20mg lexapro anxiety estudios lexapro 15mg paypal order viagra cialis 10 mg buy nolvadex d 20mg augmentin 300 mg doxycycline 400 buy viagra 100mg pakistan lexapro 2.5mg withdrawal notice glucophage 850 mg generic vega viagra cheapest viagra kamagra how 2buy viagra buy cialis zealand lisinopril arrow 10 mg lisinopril hctz 20 25mg nolvadex vs generic canada propecia 1 mg. metformin 2250 mg cialis 800 mg efecto cheap kamagra bangkok cipro xr generico vanzari online viagra erythromycin 333 mg prednisone 30 mg bronchitis buying valtrex online 50 vs 100mg clomid propecia merck buy erythromycin 250 mg adalah amoxil de 875 mg bactrim de 800 mg medicament prednisone 50mg glucophage retard 850 mg shop cheap viagra doxycycline 100mg generic strattera 60 mg yahoo buy cytotec us lasix furosemide 25 mg viagra dapoxetine online cialis 20 online nongeneric viagra amoxil 0.5mg 50 mg generic viagra buy Cialis Jelly 90 celebrex 200 mg espanol augmentin 1000 mg dosage propecia 1mg walmart buy kamagra prague cialis 10 mg pack kamagra gel 100 mg zithromax 600 mg dose cialis 5mg cpr 28
Home Forum Download/Upload Links Search

NetTalk User Group

NetTalk User Group Meeting!
Live Webinar!
Saturday Nov. 16 
7am PST
Click Here To Register!
Home arrow Forum arrow NetTalk Web Serverarrow Web Server - Share Knowledgearrow Security: HTML Injection / XSS attacks.
NetTalk Central
July 30, 2015, 02:04:31 AM *
Welcome, Guest. Please login or register.

Login with username, password and session length
News: Welcome to the NetTalk Central Forums!
 
   Home   Help Search Login Register  
Pages: [1]
  Print  
Author Topic: Security: HTML Injection / XSS attacks.  (Read 2382 times)
Bruce
Global Moderator
Hero Member
*****
Posts: 7663



View Profile
« on: August 16, 2012, 02:01:09 AM »

HTML Injection is a security issue which occurs when you let users enter "html" content. So, for example, if you have a text control on a form, and Allow xHTML is on, then you're allowing the user to enter HTML and content, and then you will display that content using their HTML markup.

Unfortunately HTML is not limited to visual markup though. It includes things like the <script> tag, which allow code to be embedded inside the content. When unwanted html appears in user content, that is called HTML Injection. If the code they inject is JavaScript then that is the start of a "Cross Site Scripting" (XSS) attack.

If this code runs on _another_ users browser (no code runs on the server), then the attacker may be able to get information from them, or their computer in a way that the programmer did not expect, or intend.

In short, "cosmetics good, code bad."

For builds of NetTalk before 6.40 it was the responsibility of the developer (you) to make sure that anywhere you ticked on "allow xHtml", you checked that the xHtml you were displaying was "safe". However that's hard to do.

Scrubbing html of code is tricky because there are a large number of vectors that can be used. the <script> tag is not hard to remove, but it's the tip of the iceberg. So, to make it a bit easier, and ultimately more secure, from build 6.40, NetTalk has automatic scrubbing built in.

NetTalk uses a whitelist approach, accepting html it specifically recognizes as valid, and rejecting unrecognized html. This makes it more secure (because "new attacks" generally fall into the "unrecognized" camp.) The alternative (searching for specific bad code) may require updating regularly as new attack vectors are discovered.

In other words, some perfectly legitimate html tags are "blanket excluded" simply because they allow the user too much power. The legal tags excluded in this way are;

Excluded (by design):
base, body, button, canvas, comments, command, datalist, embed, eventsource, frameset, frame, form, head, html, iframe, input, keygen, link, menu, meta, nav, object, optgroup, option, param, script, select, style & textarea

In other words, content stored in your database, which will be displayed via a browse or form or whatever, will not be allowed to contain these tags.

Let me be 100% clear here. This does not affect the xHTML tab (where you can enter your own custom xHtml). It does not affect the html being generated by the templates. It only applies to html which is being read from the database - ie those places where you have explicitly ticked on "Allow xHTML".

The downside with this approach is that some "legitimate" HTML is not allowed. For example, the Hyperlinks example has a browse (BrowseMedia) which included HTML  (youtube videos) containing <iframe> and <object>. Since those are both on the "not allowed" list, they are (by default) no longer playable. This may affect your application if you currently have very rich HTML content stored in your database.

So an extra switch has been added to the template wherever an "Allow xHTML" option is located, there's now also an option to "Allow UNSAFE xHtml". This puts the onus back on you to scrub the HTML in an appropriate way.
But wait, there's more...

You may want to change the list of tags that are allowed, either by adding more allowable tags, or by disallowing some tags which are allowed by default. In this way you can adjust the level of safety, without having to go to a completely unsafe mode. To do this you can embed code in the .TagOk method in the WebServer procedure. for example;

case lower(p_tag)
of 'object'
  return true
end


Embedding this before the parent call, would make the <object> tag allowable.

As always, security remains a process, not a destination, so remaining up to date (or reasonably up to date) with NetTalk builds is always recommended.
Logged
Niels Larsen
Full Member
***
Posts: 202


View Profile Email
« Reply #1 on: August 16, 2012, 07:06:28 AM »

I've never thought of that. Nice to have "someone" to do the hard work for you.
Thanks!!
Logged
RayA
Newbie
*
Posts: 43


View Profile WWW Email
« Reply #2 on: August 16, 2012, 01:00:15 PM »

 Grin

This is why we pay Bruce the BIG BUCKS!

Great Post Bruce!  Very informative!

 Grin

« Last Edit: August 16, 2012, 01:02:24 PM by RayA » Logged
Pages: [1]
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.11 | SMF © 2006-2009, Simple Machines LLC
Joomla Bridge by JoomlaHacks.com
Valid XHTML 1.0! Valid CSS!

Login Form

Welcome Guest.






Lost Password?
No account yet? Register
home contact search contact search