CWE-80: Improper Sanitization of Script-Related HTML Tags in a Web Page (Basic XSS)
Improper Sanitization of Script-Related HTML Tags in a Web Page (Basic XSS)
Weakness ID: 80 (Weakness Variant)
Status: Incomplete
Description
Description Summary
The software receives input from an upstream component, but it
does not sanitize or incorrectly sanitizes special characters such as
"<", ">", and "&" that could be interpreted as
web-scripting elements when they are sent to a downstream component that
processes web pages.
Extended Description
This may allow such characters to be treated as control characters, which
are executed client-side in the context of the user's session. Although this
can be classified as an injection problem, the more pertinent issue is the
failure to convert such special characters to respective context-appropriate
entities before displaying them to the user.
Time of Introduction
Implementation
Applicable Platforms
Languages
All
Likelihood of Exploit
High to Very High
Demonstrative Examples
Example 1
In the following example, a guestbook comment isn't properly
sanitized for script-related tags before being displayed in a client
browser.
(Bad Code)
JSP
<% for (Iterator i = guestbook.iterator(); i.hasNext(); )
{
Carefully check each input parameter against a rigorous positive
specification (white list) defining the specific characters and format
allowed. All input should be sanitized, not just parameters that the
user is supposed to specify, but all data in the request, including
hidden fields, cookies, headers, the URL itself, and so forth. A common
mistake that leads to continuing XSS vulnerabilities is to validate only
fields that are expected to be redisplayed by the site. We often
encounter data from the request that is reflected by the application
server or the application that the development team did not anticipate.
Also, a field that is not currently reflected may be used by a future
developer. Therefore, validating ALL parts of the HTTP request is
recommended.
This involves "HTML Entity Encoding" all non-alphanumeric characters
from data that was received from the user and is now being written to
the request.
With Struts, you should write all data from form beans with the bean's
filter attribute set to true.
Additionally, to help mitigate XSS attacks against the user's session
cookie, set the session cookie to be HttpOnly. In browsers that support
the HttpOnly feature (such as Internet Explorer), this attribute
prevents the user's session cookie from being accessed by client-side
scripts, including scripts inserted due to a XSS attack.
Weakness Ordinalities
Ordinality
Description
Primary
(where the
weakness exists independent of other weaknesses)
Description
