Need

Prevention of cross-site scripting attacks

Context

• Usage of PHP 5.4+ for developing web applications
• Usage of PHP for server-side scripting and web development

Description

Non compliant code

        $document

In the above PHP code snippet, the application is taking a GET parameter document directly from the URL and echoing it back to the user inside a div tag. This is a typical example of a DOM-based Cross-Site Scripting (XSS) vulnerability.

The problem here is that the application does not validate or sanitize the document parameter before echoing it back to the user. This means that an attacker could inject malicious scripts by modifying the document parameter in the URL.

For instance, an attacker could use a URL like http://example.com/page.php?document=. When this URL is visited, the malicious script would be executed in the user's browser, potentially leading to various security issues such as stealing sensitive data, session hijacking, or other malicious actions performed under the user's identity.

This kind of vulnerability is particularly dangerous because it's executed on the client side (in the user's browser), making it harder to detect and prevent from the server side.

Steps

• Sanitize the input: Before using any user-supplied data in your page, make sure to sanitize it to make it safe to display in a page. This can be done using functions that encode potentially dangerous characters.
• Use output encoding: When outputting user controlled data, use an appropriate output encoding function to prevent any potentially malicious data from being executed as code in the browser.
• Implement Content Security Policy (CSP): CSP is a security layer that helps to detect and mitigate certain types of attacks, including XSS and data injection attacks.
• Use HTTPOnly cookies: If you store session information in cookies, make sure to use HTTPOnly cookies. This makes it harder for an attacker to steal the session cookie with XSS.
• Use secure and updated libraries: If you use libraries or other third party code, make sure they are secure and always use the latest version. Older versions might have known vulnerabilities that can be exploited.

Compliant code

        $document

The original code was vulnerable to DOM-Based Cross-Site Scripting (XSS) attacks because it directly used user-supplied data ( $_GET['document']) in the page without sanitizing it. This could allow an attacker to inject malicious scripts into the page, which would then be executed in the browser of any user viewing the page.

The fixed code mitigates this vulnerability by using the htmlspecialchars() function to sanitize the user-supplied data before it is used in the page. This function converts special characters to their HTML-encoded equivalents. For example, it converts < to <, > to >, " to ", and ' to '. This prevents any potentially malicious scripts from being executed in the user's browser.

In addition to this code fix, it is recommended to implement further security measures such as Content Security Policy (CSP), using HTTPOnly cookies, and ensuring that all used libraries are secure and up-to-date.

References

• 371. DOM-Based cross-site scripting (XSS)