prevent xss attack via url( PHP)

Question

I am trying to avoid XSS attack via url
url :http://example.com/onlineArcNew/html/terms_conditions_1.php/%22ns=%22alert%280x0000DC%29 I have tried

var_dump(filter_var('http://10.0.4.2/onlineArcNew/html/terms_conditions_1.php/%22ns=%22alert%280x0000DC%29', FILTER_VALIDATE_URL));

and other url_validation using regex but not worked at all. above link shows all the information but my css and some java script function doesn't work. please suggest the best possible solution...

Arvo

If this link your URL or the link is from database ... because if its from URL .. you should filter $_GET – Scalar

I am not getting or dealing with any parameter on this page.. – Arvo

What do you mean by you are not getting any parameter on this page ? – Scalar

there is no use of any variable so i can filter $_GET – Arvo

why regex doesn't work? I don't understand use preg_match and in regex put characters that are allowed for example [a-zA-Z0-9]+ regex should be used on params. – Funicular

@Funicular i am not expert in writing pattern.. – Arvo

Answer 1

Try using FILTER_SANITIZE_SPECIAL_CHARS Instead

$url = 'http://10.0.4.2/onlineArcNew/html/terms_conditions_1.php/%22ns=%22alert%280x0000DC%29';

// Original
echo $url, PHP_EOL;

// Sanitise
echo sanitiseURL($url), PHP_EOL;

// Satitise + URL encode
echo sanitiseURL($url, true), PHP_EOL;

Output

http://10.0.4.2/onlineArcNew/html/terms_conditions_1.php/%22ns=%22alert%280x0000DC%29
http://10.0.4.2/onlineArcNew/html/terms_conditions_1.php/"ns="alert(0x0000DC)
http%3A%2F%2F10.0.4.2%2FonlineArcNew%2Fhtml%2Fterms_conditions_1.php%2F%26%2334%3Bns%3D%26%2334%3Balert%280x0000DC%29

Function Used

function sanitiseURL($url, $encode = false) {
    $url = filter_var(urldecode($url), FILTER_SANITIZE_SPECIAL_CHARS);
    if (! filter_var($url, FILTER_VALIDATE_URL))
        return false;
    return $encode ? urlencode($url) : $url;
}

Scalar

well i tried this also but i don't have to store it ,i have to execute this link,at end of line it contains javascript function,this function says it valid url so doesn't solve my purposes.. – Arvo

Answer 2

If you're using MVC, then try to decode all ofthe values before routing, and use stript_tags() to get rid of these nasties. And as the docs say, case should not impact anything.

If not, create a utility function and do the same while retrieveing the variables from the URI. But I am by no means an XSS expert, so this might be just a part of the trick.

From Janis Peisenieks

Chayachayote

Answer 3

Step 1: Escape Output Provided by Users

If you want to include data within a page that’s been provided by users, escape the output. And, in this simplified list, we’re going to stick with one simple escape operation: HTML encode any <, >, &, ‘, “. For example, PHP provides the htmlspecialchars() function to accomplish this common task.

Step 2: Always Use XHTML

Read through OWASP’s XSS prevention strategies, and it becomes apparent that protecting against injection requires much more effort if you use unquoted attributes in your HTML. In contrast, in quoted attributes, escaping data becomes the same process needed to escape data for content within tags, the escape operation we already outlined above. That’s because the only troublemaker in terms of sneaking in structurally significant content within the context of a quoted attribute is the closing quote.

Obviously, your markup doesn’t have to be XHTML in order to contain quoted attributes. However, shooting for and validating against XHTML makes it easy to test if all of the attributes are quoted.

Step 3: Only Allow Alphanumeric Data Values in CSS and JavaScript

We need to limit the data you allow from users that will be output within CSS and Javascript sections of the page to alphanumeric (e.g., a regex like [a-zA-Z0-9]+) types, and make sure they are used in a context in which they truly represent values. In Javascript this means user data should only be output within quoted strings assigned to variables (e.g., var userId = “ALPHANUMERIC_USER_ID_HERE”;.) In CSS this means that user data should only be output within the context for a property value (e.g., p { color: #ALPHANUMERIC_USER_COLOR_HERE;}.) This might seem Draconian, but, hey, this is supposed to be a simple XSS tutorial

Now, to be clear, you should always validate user data to make sure it meets your expectations, even for data that’s output within tags or attributes, as in the earlier examples. However, it’s especially important for CSS and JavaScript regions, as the complexity of the possible data structures makes it exceedingly difficult to prevent XSS attacks.

Common data you might want users to be able supply to your JavaScript such as Facebook, Youtube, and Twitter ID’s can all be used whilst accommodating this restriction. And, CSS color attributes and other styles can be integrated, too.

Step 4: URL-Encode URL Query String Parameters

If user data is output within a URL parameter of a link query string, make sure to URL-encode the data. Again, using PHP as example, you can simply use the urlencode() function. Now, let’s be clear on this and work through a couple examples, as I’ve seen much confusion concerning this particular point.

Must URL-encode

The following example outputs user data that must be URL-encoded because it is used as a value in the query string.

http://site.com?id=USER_DATA_HERE_MUST_BE_URL_ENCODED”>

Must Not URL-Encode

The following example outputs the user-supplied data for the entire URL. In this case, the user data should be escaped with the standard escape function (HTML encode any <, >, &, ‘, “), not URL-encoded. URL-encoding this example would lead to malformed links.

Chayachayote

I have also used url_encode but it can't prevent from what i asked in my question. – Arvo

Step 2: Always Use XHTML. Dude what about HTML5? – Funicular

@Funicular site made in core php and and a very long time ago so,please let me know can i validate these type of url as bad url... – Arvo