CODEWITHSUNDEEP
spring-securityxss
ejaenv
ejaenv

Reputation: 2387

spring security native xss filter

Why Spring Security doesn't provide any XSS filter to clean the form input values?

Accordingly to this ticket, such XSS filter is a low priority: https://jira.spring.io/browse/SEC-2167?jql=text%20~%20%22xss%22

(although the ticket speaks only about URL querystring. Sanitizing POST params would be also required)

In my opinion it would be really useful that spring would provide such a filter instead of building your own. This filter it's a recurrent problem.

Upvotes: 2

Views: 1759

Answers (1)

SilverlightFox
SilverlightFox

Reputation: 33538

XSS is best handled at output stage via the use of encoding. That is, store everything in your database as is, and yes storing <script> is fine, however once output, encode correctly for the context it is output in. For HTML this would be &lt;script&gt;, however if your output context was plain text you would just output as is <script> (assuming the same character set encoding is used). Side note: Use parameterised queries or equivalent for storing in your database to avoid SQL injection, however the text stored should exactly match what was entered.

Microsoft attempts to block inputs that look like XSS via their request validation feature in ASP.NET. However, this isn't very effective and flaws are found quite often. Similar approaches from other frameworks are doomed to fail.

The reason that this is much better is that it makes things much more simple. Imagine if StackOverflow didn't allow HTML or script tags - the site would not be functional as a place for people to post code snippets.

You can use input validation as second line of defence. For example, if you are asking the user to enter their car registration you would only want to allow alphanumerics and space to be entered. However, for more complex fields it is often difficult to restrict input to a safe set as output context is unknown at this stage.

Say your language filtered < and > characters. However you were outputting user input into the following context.

<img src="foo.jpg" alt="USER-INPUT" />

An XSS attack is possible by entering " onmouseover="alert('xss') because it would be rendered as

<img src="foo.jpg" alt="" onmouseover="alert('xss')" />

Similar problems would ensue if you were outputting to JavaScript server-side. This is why it should be up to the developer to select the correct encoding type when using user controlled values.

Upvotes: 2

Related Questions