CODEWITHSUNDEEP
javascriptsecurityxsscsrfaurelia
MattjeS
MattjeS

Reputation: 1397

Is CSRF possible in Aurelia if XSS attacks are mitigated?

I've heard that this is insecure as the token can be retrieved through an XSS attack. There is only one input on the website where a user can add comments. However I'm binding the comment value using string interpolation e.g.:

${commentText}

My understanding is that it is impossible to inject html into a binding like this.

Is there an XSS attack possible with an aurelia site if no html bindings are used? And if not, am I therefore protected by CSRF attacks if the token is inaccessible?

The only examples I've seen online, is if a user can inject html (through some form of input) into a page in a XSS attack revealing the token to the attacker. I haven't been able to replicate that with the string interpolation binding.

Upvotes: 1

Views: 526

Answers (1)

Ashley Grant
Ashley Grant

Reputation: 10887

This isn't a full answer to your question, but Aurelia does HTML escape any text that is interpolated in to a template like with ${commentText}.

The only exception to this rule is when you use the innerhtml binding like this <div innerhtml.bind=“htmlText”></div>. In that case we don't do any sanitization of the text being sent as HTML. That's up to you.

Upvotes: 1

Related Questions