CODEWITHSUNDEEP
asp.neturl-rewritingxss
Drakarian
Drakarian

Reputation: 93

Prevent Javascript in URL attacks (asp.net)

I've seen plenty of Cross-Site Scripting attack prevention suggestions, but I'm not asking about Form Input validation. How would I prevent something like this:

javascript:(function(i,j){with(document){for(i=0;i<forms.length;++i){with(forms[i]){for(j=0;j<elements.length;++j){elements[j].disabled=false}}}}})()

from being inserted into the URL? This code would enable all form elements on a page if added to a URL. So if you disabled certain buttons based due to permissions or something then all those buttons would become enabled.

Should I just be parsing the URL and check for the Javascript keyword?

Upvotes: 0

Views: 1424

Answers (2)

D&#39;Arcy Rittich
D&#39;Arcy Rittich

Reputation: 171579

The key is to not worry much about it client-side. Server-side is where you have to be bullet-proof. Do not assume, for example, that just because you named your form inputs the same as your database column names, that you can just loop through Request.Form and persist all the data you get. You should validate that you only process the inputs you are expecting, and validate them for data type and range, as well as considering the user's permissions to alter a given field.

That way, the user can send whatever they want, you will only process and accept valid data server-side.

Upvotes: 0

Noon Silk
Noon Silk

Reputation: 55182

No. You can't, anyway, as it doesn't get sent to the server.

That is just JavaScript executed locally by the user themselves. It should mean nothing to you. The security of your system should never rely on client-side javascript, all your authentication, and so on, should be done server-side.

Upvotes: 3

Related Questions