search

tugrul / aspjson

JSON for ASP
34 stars 20 forks source link

Encode key to avoid escaping vulnerability #10

Closed cmbuckley closed 3 years ago

cmbuckley commented 3 years ago

It is possible to construct a key that may result in an XSS vulnerability if user data is used to construct JSON:

<!--#include file="JSON.asp"-->
<%
    Dim json
    Set json = jsObject()
    json("key"":""value"",""secondkey") = """"
    response.Write(json.jsString)
%>

This will result in output that breaks out of the first key:

{"key":"value","secondkey":"\""}

The patch runs the (quoted) key through jsEncode, which results in the following:

{"key\":\"value\",\"secondkey":"\""}
tugrul commented 3 years ago

thanks 👍