XSS COUNTERMEASURES

It is quite hard to detect and remove XSS flaws from web applications which leads to XSS Attacks on the websites. The best way to find these flaws is to perform security review of the code, and search all the places where input from an HTTP request comes as an output through HTML because these locations can be used by an attacker to attack a particular website.

 #1 – Using HTML Escape Previous to Inserting Data to HTML Element Content

“<" introduces a tag.

“&” introduces a character entity.

Few of the available browsers try to correct automatically the poorly formatted HTML and treat “>” as if it were “<".

#2 - Attribute Escape for HTML Common Attributes

            These can be done using encoding. Sensitive Attribute should be encoded into suitable code. Except for the alpha-numeric characters, escape all the characters with ASCII values less than 256 with the &#xHH; format to prevent switching out of the attribute unnecessarily. And, it makes the WebSite more secure to XSS Attacks.

#3 - JavaScript Escape for JavaScript Data Values

            =>JavaScript should be escaped and properly ended and poorly ended javascript quotes can allow an attacker to insert his own java codes on the page and run them from there. JavaScript Escape for JavaScript Values if used would disable an attacker to insert any unwanted part of code into the webpage.

#4 - CSS Escape & Validation

            => Untrusted CSS data should only be entered in a property value and not into other places in style data. CSS is a very powerful language and it may help an attacker to attack in various ways through Cascaded Style Sheets (popularly known as CSS).

For example:

<style>selector { property : ...ESCAPE UNTRUSTED DATA HERE...; } </style>

{ background-url : "javascript:alert(1)"; }  // and all other URLs

 { text-size: "expression(alert('XSS'))"; }   // only in IE

 #5 - URL Escape for URL Parameter Values

            => URL Escape should be used if a sensitive URL is to be encoded and it should be validated. This feature adds security to the webpage. It is used when URL is be encoded which sends data through GET. For this purpose URL Encoder should be used.

String safe = ESAPI.encoder().encodeForURL( request.getParameter( "input" ) );

#6 - Use the <frame> Security Attribute

Most of the latest browsers support <frame> and <iframe> and it must be used with “Restricted” parameter as it gives restriction to that particular frame thereby increasing the security against XSS Attacks.

Examples:           Contact Me On Facebook =>www.fb.com/ryan.manjothi

<script>...DON’T INSERT UNTRUSTED DATA HERE...</script>    Used directly in a script

 <!--...DON’T INSERT UNTRUSTED DATA HERE...-->             Used inside an HTML comment

 <div ...DON’T INSERT UNTRUSTED DATA HERE...=try />        Used in an attribute name

 <DON’T INSERT UNTRUSTED DA