free fake valid credit card numbers best interest free credit card balance transfer 76 gas credit card login best interest free credit card offers teachers credit union secured credit cards how do i get a credit card with no credit score best credit card malaysia interest rate are visa gift cards credit or debit barclays credit card uae promotions list of credit card processing companies canada rewards 660 visa credit card application icici credit card irctc offer best credit card in canada for students mbna credit card canada cash back kisan credit card interest rate sbi key ring reward cards android ann taylor loft credit card sign in ann taylor loft credit card cancel lowest rate credit cards 2013 0 balance transfer no fee top 10 0 balance transfer credit cards sbi credit card payment by cash credit card verification code fake hdfc silver credit card apply online does missouri dmv accept credit cards united airlines mileage plus credit card promotion 0 balance transfer barclaycard who accepts visa debit cards online guaranteed credit cards uk hilton credit card authorization form chase credit card approval odds credit card interest explained canada best credit card offers experian credit report netspend prepaid visa prepaid mastercard prepaid credit cards prepaid debit credit card instant decision bad credit credit card repayment calculator fnb credit card transaction fees explained shoppers drug mart credit card login best cashback credit card canada 2013 sbi credit card customer care number chandigarh capital one student credit card requirements cash back credit cards for business walmart credit card cash advance interest best credit cards for travel in europe instant online payday loans for bad credit south africa instant payday loans online direct lenders credit card exchange rates canada balance transfer credit card offers australia orchard bank credit card payment hold uk credit card no foreign transaction fees real working credit card numbers 2011 bank of america amazon credit card terms and conditions instant credit card number paypal credit card reward reviews 2013 orchard bank unsecured credit cards for bad credit heartland payment systems credit card processing fees should i pay loans or invest best business credit card canada 2013 halo reach credit limit offline va home loan with bad credit direct cash advance lenders online how to stop pre approved credit card applications chase bank credit cards for bad credit aib visa credit card services 10 best credit cards to have sbi credit card payment login credit cards rewards hbc credit card reward points american express costco credit card sign in balance transfer handling fee explained orchard bank platinum credit card reviews credit card merchant services comparison applying for credit cards hurt your credit score online payday loans easiest store credit cards to get with no credit application for citibank credit card philippines first financial bank student credit card lord and taylor credit card 12 month interest free balance transfer credit cards bodog credit card verification agreement hrsaccount best buy credit card login secured credit card canada bad credit belk credit card minimum payment credit cards for business with bad credit pay capital city credit card santander 123 cashback credit card annual fee capital one credit cards usa credit card offer opt out prescreened offers hsbc debit visa card account number cash advance credit card credit card balance transfers 0 interest hsbc credit card promotions lloyds tsb credit card fees abroad apply for wells fargo secured credit card my first credit card no credit history how to break a door lock with a credit card best canadian credit cards 2012 credit card zip code for canadian credit cards applying for a credit card uk credit cards application process credit card fraud protection visa high school student credit cards no credit history do i need a credit card for my itunes account simmons first credit card payments visa cards to help rebuild credit citibank government travel credit card login apply barclays premier credit card amazon instant video prepaid credit card is it harder to get a credit card now walmart 24 month interest free credit card matrix secured credit card by discover no credit history credit cards instant approval platinum credit cards wiki best credit cards for college students with low interest rates hsbc customer care credit card secured credit card for bad credit no deposit what is a good credit card interest rate in canada should i report credit card fraud to police iphone mobile credit card processing canada credit card companies with uk call centres how to choose a credit card uk best credit card business expenses exploration of data mining techniques in fraud detection credit card 0 balance transfer credit cards for students chase freedom credit card international fees freedom credit card login tesco credit card balance transfer code bank of america credit card payment address easy store credit cards to qualify for apply online credit card hsbc bank credit card fraud for dummies full documentary visa credit card canada customer service bad credit bank accounts lloyds best credit card interest rates balance transfer safe online loan companies fast cash loans now credit card rate comparison canada dfas pcs pay advance intuit accept credit cards online credit card loan calculator visa credit card application for bad credit who is liable to pay advance tax credit card limit reduced without notice how credit card processing works video high limit credit cards for good credit do you need a credit card to rent a car how long does it take to get a natwest student credit card best credit cards to earn travel rewards american express starwood credit card review wizard clear advantage mastercard credit card personal online loans review short term cash loans no credit check tesco credit card minimum payment due pay as you go credit cards compare new york and company credit card payment site pay orchard credit card by phone us bank credit card approval rates best bank to get a credit card with no credit best practices for storing credit card information pay off credit card debt or save get a credit card today uk apply for old orchard bank credit card capital one secured credit card limit canada barclaycard platinum credit card with extended balance transfer credit score needed for sunoco gas card credit card holder wallet ebay reputable credit card consolidation companies what is my credit limit virgin mobile venture one capital credit card planet fitness black card cancellation fee largest private label credit card issuers us bank credit card bill payment standard chartered credit card customer care kerala hdfc credit card helpline no delhi can i sell my old credit card machine compare credit cards cash back rewards credit card with most cash back rewards payday loans lenders online how to get a black american express credit card can i get a credit card online credit card reward points comparison get pre approved for a credit card online unsecured credit cards for really bad credit uk spg credit card offers 2013 my black card visa where to buy prepaid credit cards vancouver same day 3 month payday loans credit card machine rolls uk apply for firestone credit card average uk credit card debt 2011 pay valero gas credit card credit card payoff calculator with amortization delta airlines credit card deal chase mastercard credit card logon old navy visa card number go mastercard can you use td visa debit cards online best interest rate credit cards australia getting a credit card with bad credit in south africa which chase credit card has no foreign transaction fee mobile credit card services for small business compare credit card rates uk air canada credit card aeroplan virtual credit card usaa nedbank credit card limit increase citibank credit card application form online loans with bad credit and no job personal online loans with installment guaranteed unsecured bad credit loan black card benefits visa prepaid credit card ireland o2 upromise credit card student loan aqua credit card application status credit card calculator uk black cardboard boxes with lids chase freedom credit card customer service do i need a credit card to start an itunes account best student credit cards for travel abroad get around ryanair credit card charges online prepaid credit card japan how can i consolidate my credit cards into one payment capital one visa secured credit card prepaid gift credit cards uk visa card services virgin media shadow credit limit ebay india hdfc credit card offers platinum credit cards australia annual gold card partner card free app android mobile phone credit card processing chase credit card verification phone number reward credit cards comparison canada td canada trust credit cards for students bad credit credit cards unsecured no deposit required international credit card processing iphone best credit cards to start rebuilding credit lufthansa miles and more credit card usa discover matrix credit card status citibank credit card international use secured credit card credit rating unsecured credit cards for fair credit verifone credit card machines troubleshooting visa card generator download annual gold card rail free credit card numbers that work with security code and expiration date 2013 credit cards travel insurance virgin pay as you go credit cards best way for a college student to get a credit card chase mastercard credit card services low credit score credit cards usa secured bad credit loan best fixed rate credit cards 2012 best rewards credit cards 2014 vanquis credit card can i ask my credit card company for a settlement figure 0 balance transfer cards explained what happens to my credit score if i cancel a credit card how to register visa card for online shopping how to get a secured business credit card credit card debt after death in canada what are the best credit cards to build your credit credit score calculator uk guaranteed acceptance payday loan lender hdfc credit card customer care number india borgata black card benefits credit cards travel promotion orchard bank secured visa credit cards secured credit cards bad credit no deposits apply for a sears canada credit card gymboree us bank credit card login bank of america business account accepting credit cards credit card machine paper rolls office depot portable credit card machine cost car loans with bad credit pcs pay advance army natwest student credit card uk can i apply for a chase credit card online hdfc credit card loan contact number valid credit card numbers that work 2011 mortgages for bad credit first time buyers belk credit card payment over the phone portable credit card machine ireland 0 credit card balance transfers no fee low interest life of balance transfer credit card macy;s credit card approval process splunk credit card search department store credit cards credit score interest free balance transfer credit card deals capital one credit card login united states apply for a visa credit card online credit card types in icici bank how to get a visa gift card to work online how to remove credit card details from apple id international credit card charges citibank transfer credit card balance 0 best value credit card low interest credit card offers for fair credit use hdfc reward points platinum credit cards best credit card rewards martin lewis best cashback credit card deals uk checklist for comparing credit cards payday loans like united cash loans same day loans pay back monthly delta reserve credit card benefits credit card protection plan bank of america hdfc credit card search best value credit card rewards canada hdfc credit card payment online from hdfc bank pc credit card processing what are credit cards and debit cards identifying credit card types by number credit card logos for website use reloadable prepaid visa cards india tesco credit card points petrol key bank credit card processing wireless credit card terminal for small business halo reach credit limit removed kroger visa rewards card login paypal credit card machine iphone what is the best credit card for rewards uk is it bad to open new credit cards unsecured credit cards after bankruptcy 2011 credit card 0 interest for 24 months canada credit cards applications online instant approval what are the best 5 credit cards for bad credit accepting credit card payments on android phone secured discover credit cards free balance transfer credit cards in uae citibank credit card online application philippines what is the best credit card to get right now best travel reward credit cards 2011 canada zero interest credit card chase business credit card logon anz prepaid visa credit cards no interest credit card canada santander credit card balance transfer overdraft hsbc credit card insurance uk make walmart credit card payment does bank of america offer virtual credit card numbers capital one secured credit card review canada best airmiles credit card canada 2013 hdfc credit card login reward points pnc pay loans online chase cash advance credit card discover more credit card for students best reward credit cards uk eliminate unsecured credit card debt can i use my ge capital credit card at walmart virgin atlantic credit card balance transfer neiman marcus credit card rewards credit card minimum payment calculator canada hdfc credit card statement on email best alaska airlines credit card deal visa black credit card reviews singapore credit card movie deal credit card cash advances explained td first class travel visa infinite card login prepaid credit cards canada reviews my payday advance loan business credit cards online approval tesco visa gift card online iphone credit card processing uk visa credit card number starts with 4 what is the best credit card for students to build credit smartphone app for accepting credit cards get credit card with bad credit australia cibc credit card lost or stolen aib visa debit cards furniture store credit cards bad credit high limit secured credit card for bad credit chase southwest credit card phone number bank of america credit card rewards review hsbc credit card points premier hdfc international credit card reward points costco credit card application free balance transfer credit card click to pay icici bank credit cards barclays student credit card uk tesco visa credit card online yatra standard chartered platinum credit card credit card fraud online orders which unfair credit card charges shell citi credit card login how do i get a visa card online aspire credit card contact number chase credit card travel rewards credit card cashback taxable income calculate interest paid on credit card balance first time credit card to build credit best value credit cards nz apply visa signature credit cards best credit card reward offers 2011 easy credit card approval canada credit card numbers that work 2013 no download can i use my business credit card for personal purchases pay pc richards credit card online credit card after bankruptcy discharge 2011 excel credit card apr formula can you pre pay credit cards hsbc canada credit card phone number chase credit card minimum payment percentage visa gift card online registration aadvantage credit card uk mbna cheap credit cards balance transfers best gas credit cards penfed visa credit card services usa frontier barclays credit card login credit card cash advance without pin number denied secured credit card capital one credit cards offers uk uk prepaid credit card online eliminate credit card debt fast top credit cards for bad credit 2013 credit cards with rewards for travel hdfc bank credit card short term loans online canada reputable credit card debt settlement companies credit card cash back visa gold best rewards credit card canada no annual fee best cash back reward credit cards 2011 bad credit loans unsecured uk citibank credit cards balance transfer offers accept credit cards visa credit card travel insurance uk minimum credit score for firestone credit card easy credit card approval for students best cashback credit cards 2013 singapore amazon credit card credit limit visa credit card number format credit cards with no annual fees in india secured canadian credit cards for bad credit hdfc credit card payment charges how to get credit card with bad credit citibank balance transfer cancel hbc mastercard credit card orange prepaid credit card top up accepting credit cards with iphone 4 cash back visa sample credit card number for itunes no credit credit card capital one citibank student credit card singapore veda credit check kisan credit card interest rate in rajasthan does applying for credit cards and getting denied hurt your credit aeroplan credit card canada no annual fee best credit card apps for blackberry credit card with travel rewards no annual fee when was the first american express credit card issued united mileage plus credit card customer service phone number cash loans for bad credit in cape town major credit card issuers in india platinum delta skymiles credit card review best airline rewards credit cards 2013 best online loan companies paypal mobile credit card processing canada compare credit card rewards australia credit limit increase citi best travel rewards credit cards canada 2011 standard chartered credit card application status customer care best credit card processing companies canada chase slate no balance transfer fee applying for a credit card with bad credit in canada who accepts visa debit cards in canada best credit cards with no annual fee for fair credit no fee no credit credit cards apply for credit card hsbc automatic opt-out from pre-approved credit card activate td visa gift card mastercard capital one credit card login best 0 interest free credit cards using icici virtual credit card bank of america credit card application decision do i need a credit card to rebuild my credit credit card bank of ireland services who regulates credit card processing companies shell credit card application form online credit card verification software instant credit cards for students credit card processing fees illegal cancel credit card affect credit score corporate credit card policy example mastercard prepaid credit cards ireland best secured credit card with no annual fee where to buy debit visa cards low interest business credit cards canada compare best credit cards uk credit cards wikihow top 10 rewards credit cards canada online loan lenders for bad credit visa black card credit requirements compare citi student credit cards how to avoid ryanair credit card charges discover credit card payment center grand hyatt san antonio credit card authorization form capital one first premier credit card capital one credit card travel notification instant payday loan no credit check no faxing top online payday lenders virgin money uk - credit cards mortgages savings isas unsecured credit card bad credit no annual fee
Home Forum Download/Upload Links Search

NetTalk User Group

NetTalk User Group Meeting!
Live Webinar!
Saturday Nov. 16 
7am PST
Click Here To Register!
Home arrow Forum arrow NetTalk Web Serverarrow Web Server - Share Knowledgearrow Security: HTML Injection / XSS attacks.
NetTalk Central
August 31, 2015, 05:46:30 PM *
Welcome, Guest. Please login or register.

Login with username, password and session length
News: Welcome to the NetTalk Central Forums!
 
   Home   Help Search Login Register  
Pages: [1]
  Print  
Author Topic: Security: HTML Injection / XSS attacks.  (Read 2428 times)
Bruce
Global Moderator
Hero Member
*****
Posts: 7743



View Profile
« on: August 16, 2012, 02:01:09 AM »

HTML Injection is a security issue which occurs when you let users enter "html" content. So, for example, if you have a text control on a form, and Allow xHTML is on, then you're allowing the user to enter HTML and content, and then you will display that content using their HTML markup.

Unfortunately HTML is not limited to visual markup though. It includes things like the <script> tag, which allow code to be embedded inside the content. When unwanted html appears in user content, that is called HTML Injection. If the code they inject is JavaScript then that is the start of a "Cross Site Scripting" (XSS) attack.

If this code runs on _another_ users browser (no code runs on the server), then the attacker may be able to get information from them, or their computer in a way that the programmer did not expect, or intend.

In short, "cosmetics good, code bad."

For builds of NetTalk before 6.40 it was the responsibility of the developer (you) to make sure that anywhere you ticked on "allow xHtml", you checked that the xHtml you were displaying was "safe". However that's hard to do.

Scrubbing html of code is tricky because there are a large number of vectors that can be used. the <script> tag is not hard to remove, but it's the tip of the iceberg. So, to make it a bit easier, and ultimately more secure, from build 6.40, NetTalk has automatic scrubbing built in.

NetTalk uses a whitelist approach, accepting html it specifically recognizes as valid, and rejecting unrecognized html. This makes it more secure (because "new attacks" generally fall into the "unrecognized" camp.) The alternative (searching for specific bad code) may require updating regularly as new attack vectors are discovered.

In other words, some perfectly legitimate html tags are "blanket excluded" simply because they allow the user too much power. The legal tags excluded in this way are;

Excluded (by design):
base, body, button, canvas, comments, command, datalist, embed, eventsource, frameset, frame, form, head, html, iframe, input, keygen, link, menu, meta, nav, object, optgroup, option, param, script, select, style & textarea

In other words, content stored in your database, which will be displayed via a browse or form or whatever, will not be allowed to contain these tags.

Let me be 100% clear here. This does not affect the xHTML tab (where you can enter your own custom xHtml). It does not affect the html being generated by the templates. It only applies to html which is being read from the database - ie those places where you have explicitly ticked on "Allow xHTML".

The downside with this approach is that some "legitimate" HTML is not allowed. For example, the Hyperlinks example has a browse (BrowseMedia) which included HTML  (youtube videos) containing <iframe> and <object>. Since those are both on the "not allowed" list, they are (by default) no longer playable. This may affect your application if you currently have very rich HTML content stored in your database.

So an extra switch has been added to the template wherever an "Allow xHTML" option is located, there's now also an option to "Allow UNSAFE xHtml". This puts the onus back on you to scrub the HTML in an appropriate way.
But wait, there's more...

You may want to change the list of tags that are allowed, either by adding more allowable tags, or by disallowing some tags which are allowed by default. In this way you can adjust the level of safety, without having to go to a completely unsafe mode. To do this you can embed code in the .TagOk method in the WebServer procedure. for example;

case lower(p_tag)
of 'object'
  return true
end


Embedding this before the parent call, would make the <object> tag allowable.

As always, security remains a process, not a destination, so remaining up to date (or reasonably up to date) with NetTalk builds is always recommended.
Logged
Niels Larsen
Full Member
***
Posts: 202


View Profile Email
« Reply #1 on: August 16, 2012, 07:06:28 AM »

I've never thought of that. Nice to have "someone" to do the hard work for you.
Thanks!!
Logged
RayA
Newbie
*
Posts: 43


View Profile WWW Email
« Reply #2 on: August 16, 2012, 01:00:15 PM »

 Grin

This is why we pay Bruce the BIG BUCKS!

Great Post Bruce!  Very informative!

 Grin

« Last Edit: August 16, 2012, 01:02:24 PM by RayA » Logged
Pages: [1]
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.11 | SMF © 2006-2009, Simple Machines LLC
Joomla Bridge by JoomlaHacks.com
Valid XHTML 1.0! Valid CSS!

Login Form

Welcome Guest.






Lost Password?
No account yet? Register
home contact search contact search