Welcome to the third and last part of cross-site scripting session.
In this part. We will discuss cross-site, scripting
mitigation. We will start discussing what makes
an application vulnerable. And then we will handle ask Juice
Shop, vulnerable source code. Before closing, this session.
We will discuss how to avoid such vulnerabilities applications
tend to accept data from external sources
either user input or integrated third-party
services. If such data is included in
HTML responses without proper validation, and
And escaping, then the application might be vulnerable. If
you're using JavaScript Frameworks, or you have a single page
application, which using save JavaScript apis to
append, attacker controllable, data to the Dom, then,
your application should also be vulnerable. Let's
have a look at the source code.
From Project page, we will jump directly to the
GitHub repo.
Since we are dealing with client access, then we should look
inside the front end source, code folder.
We are interested in something search related.
This script has all the search Logic.
This is the search component class, which has
several properties.
This property should hold Search keywords. Let's
see where it is used.
Query parameter is passed to the bypass security,
trust HTML method implemented by the sanitizer.
It is provided by the Dom sanitizer.
Thompson advisor is part of the angular framework.
Let's check the documentation.
We should be at the right place. Let's find the method we're looking
for.
Now we know why the script didn't trigger the model.
The image date because it is considered safe
HTML by this method.
Of course, this method is used intentionally to make the application
vulnerable, but mistakes. Like, this one are
more common than you may think. Let's see how to
mitigate xss. Choose. Well, tested
and actively maintain Frameworks that automatically prevent
access by default.
All did such Frameworks to know, available options and
their limitations.
Always Escape data based on the context in the HTML
output. It will be included, depending where
the data will be displayed different scaping techniques may
be required. In force, server-side that
security directives are sent to clients. As
part of responses, consider adding appropriate security,
others enabling and
enforcing a restrictive content, security policy will help
mitigating X access as long as there is no
other exploitable vulnerability to add.
Malicious code, in our next
session. We will discuss insecure deserialization until
then take your time to carefully. Read
the cross-site. Scripting section of a wasp, top 10.