search

gurtejboparai / bookwyrm

A project for Software Engineering II WInter 2022
2 stars 3 forks source link

Create input sanitization to protect against cross site scripting attacks #205

Closed CameronJung closed 2 years ago

CameronJung commented 2 years ago

Cross code attacks can have devastating consequences, but defending against them isn't very complicated from my understanding.

CameronJung commented 2 years ago

I have a few ideas of how to do this. The one I'm thinking of right now is make a singleton in the front end that can be called by any of the services. The singleton's functions will include string searches that look for bits of html code in user input that could be used maliciously, such as "src=". If such a sequence is found than the input is rejected and the request isn't sent to the backend. I suspect this issue is more complicated than I realize so I'd like feedback on this approach.

LukeBMorrow commented 2 years ago

you could use .replaceAll() and the escaped characters: 

&lt; renders as <
&gt; renders as >
&amp; renders as &
&quot; renders as "
&apos; renders as '

Though this might interfere with the spoiler tags

CameronJung commented 2 years ago

So should this clean input that has been determined to be malicious, and send what it's able to salvage, or should it just reject the request entirely so that nothing is sent to the back end?

LukeBMorrow commented 2 years ago

Once the characters are escaped, there is no longer danger in storing whatever it is they entered. I think it should be stored to avoid a false positive rejecting someone's valid request.

CameronJung commented 2 years ago

Yeah that's a good point. Besides, if the sanitizer results in variable behavior that will make it more work to use.

CameronJung commented 2 years ago

There are three input fields I can think of that will need to be sanitized, user names, comments and reviews. Can anybody think of any others?

CameronJung commented 2 years ago

Apparently Vue protects against XSS attacks innately.