Bob Hoffman wrote:
> Since each install uses the same pages basically, it is easy for a
autobot
> to find them all and zero day your forums, xss your whatever, and so on.
>
> Dang scary to leave JS on at all....even though you basically have too.
Mozilla is beginning to address this issue with Content Security Policy
-=-
http://people.mozilla.org/~bsterne/content-security-policy/
-=-
CSP will require pro-active webmasters who use it and browsers that
enforce the client side enforcement, but it's a step in the right direction.
I wrote a php class that partially implements CSP server side as an
output filter
-=-
http://www.clfsrpm.net/xss/
-=-
It's DOMDocument based and thus requires the php xml stuff, I've only
tested it under php 5.2.9 but it should work in 5.x.
The class does have some limitations, namely the document must be fully
constructed and sent through the class before any of it is sent to the
browser so web apps that do a lot of echo() and print() have to be
re-written to not send anything until the page is fully constructed, and
I've also found it has performance issues on complex pages with a lot of
nodes, so for those kinds of pages I just create the page with the
dynamic content first, send it through the filter, then create the nodes
for static content I know is clean and use DOMDocument facilities to add
those nodes before outputing the page to the client.
It's not possible to completely implement CSP server side, but the class
will catch most violations of a CSP policy and thus give some protection
to users who are not running a CSP aware web browser.
Another gotcha with the class, it seems importHTML() is not mb safe so
if using importHTML() to get the document into a DOMDocument object for
filtering, and the document contains any multi-byte characters, it seems
libxml2 will encode them and there seems to be no way to stop it from
doing it (at least with the php wrapper to libxml2). However if the
document to be filtered is xhtml, you can use importXML() on it libxml2
does the right thing in leaving the mb characters alone. Once filtered,
you can use saveHTML() to produce html instead of xhtml for browser
compatibility, it seems saveHTML() is mb safe.
_______________________________________________
CentOS mailing list
CentOS@xxxxxxxxxx
http://lists.centos.org/mailman/listinfo/centos
