Web development arguably has two distinct eras: BFB -- the (prehistoric) time before Firebug when we learned the limits of alerts -- and the modern AFB (after Firebug) when we found that we can once again spend quality time with our families. Firebug truly is Web development evolved. Developing a Web application without using Firebug is like coding Java in vi -- it can be done, but it's just not worth the pain.
Jquery'nin yuvarlak köşeler oluşturmanızı sağlayan güzel bir eklentisi (rounded corners plug-in ) var. Bunun sayesinde resimlerin bile köşelerini yuvarlatmak mümkün.
http://www.benimsitem.com/haber.html?id=156Açık bulunanan site name değişkenini okuyup hiçbir filtreleme yapmadan sayfaya yazdırıyorsa, o zaman bu değerde istenilen kod çalıştırılabilir.
http://www.benimsitem.com/haber.html?id=<script>alert(document.cookie)</script>Genelde cross site scripting açıkları, saldırganın sistemi deneme-yanılma yaparak bulması ile ortaya çıkıyor. Açığın bulunması ile saldırgan, başka bir domainden, açığın bulunduğu domain ve sayfanın bilgilerini, session bilgilerini ve diğer obje değerlerini çalmasına olanak sağlar. (1)
public static String filterForSpecialCharacters( String inputStr ){
String outputStr = inputStr + "";
outputStr = outputStr.replace ( "'", " " );
outputStr = outputStr.replace ( "\"", " " );
outputStr = outputStr.replace ( "%", " " );
outputStr = outputStr.replace ( ";", " " );
outputStr = outputStr.replace ( "(", " " );
outputStr = outputStr.replace ( ")", " " );
outputStr = outputStr.replace ( "&", " " );
outputStr = outputStr.replace ( "+", " " );
outputStr = outputStr.replace ( "<", " " );
outputStr = outputStr.replace ( ">", " " );
return outputStr;
}
1- Introduction
Cross-Site Scripting is one of the main problems of any Web-based service. Since Web browsers support the execution of commands embedded in Web pages to enable dynamic Web pages attackers can make use of this feature to enforce the execution of malicious code in a user’s Web browser. JavaScript is the most commonly used command language in this context. If misused, stealing of authentication information may be possible thus allowing attackers to act under a stolen identity. The attack is based on the possibility to insert malicious JavaScript code into pages shown to other users. Therefore filtering malicious JavaScript code is necessary for any Web application. This paper describes the overall problem and elaborates on the possibilities to filter JavaScript in Web applications. Also a filtering architecture is presented that allows Web application developers to filter JavaScript depending on the application need to reduce the danger of successful Cross-Site Scripting attacks. (1)
2 - Avoiding an Attack
2.1 - Filtering
The basis of this approach is never trust user input and always filter metacharacters ("special" characters) that are defined in the HTML specification. Each input field, including link parameters will be validated for script tags. When found and dependent on the context, the input will be rejected and thus prevent the malicious HTML from being presented to the user. (3)
2.2-) Encoding
Cross-site scripting attacks can be avoided when a Web server adequately ensures that generated pages are properly encoded to prevent unintended execution of scripts. Each character in the ISO-8859-1 specification can be encoded using its numeric entry value. Server side encoding is a process where all dynamic content will go through an encoding function where scripting tags will be replaced with codes in the chosen character set. Generally speaking, encoding is recommended because it does not require you to make a decision about what characters could legitimately be entered and need to be passed through. Unfortunately, encoding all untrusted data can be resource intensive and may have a performance impact on some Web servers.
For More Information:
http://www.ibm.com/developerworks/tivoli/library/s-csscript/
http://www.developer.com/java/article.php/883381
Citation
-----------
(1) http://tr.wikipedia.org/wiki/Cross_site_scripting
(2) Filtering JavaScript to Prevent Cross-Site Scripting - Created by:
EUROSEC GmbH Chiffriertechnik & Sicherheit
(3) http://www.ibm.com/developerworks/tivoli/library/s-csscript/
Not a Form, a text input field and a link:
SEARCH LINK
Javascript Code:function ProcessSearchSubmit() {
linkToRedirect="/search.ovt?results=allResults&searchInput=";
if ( document.getElementById('searchInputId') ) {
linkToRedirect += document.getElementById('searchInputId').value;
}
setTimeout( "window.location.href = linkToRedirect", 0 );
}
window.location.href = url;
RedirectUrl = url;
setTimeout( "window.location.href = RedirectUrl", 0 );
