Cross Site Scripting Help

[vintage_coder]

Hi,

I'm currently trying to upgrade the security of our website and have run into a roadblock of sorts I'm hoping to get some help on. I am working on a simple page that is passed a text message and a url as two variables in a query string. Our security team is using a tool called WebInspect that trys to break the code. Right now it has broken this by appending the following to the url

+onmouseover%3dalert(%27spid%27)+

I am reading the url value with the following:

str_url = Server.htmlencode(Request.querystring("REDIRECT_URL"))

I have a javascript function that will scan a text string for illegal characters. To use it I need to convert the vbscript variable to an html variable, which I do using a hidden input statement with the name url:

<input type=hidden name="url" value=<%=str_url%>>

When I use a javascipt alert box to view the value of url it does not show any characters past the end of the actual url that I want, so when I call the javascript function it does not find any problem, so I cannot test this way. My real problem occurs when I try to redirect the page. This is done when a button is clicked, using the following code:

<input type=button name="" value="Click Here" onclick="location.href='<%=str_url%>'" ID="Button1">

This is pretty standard, but in this case, str_url, as I explained before, contains the appended garbage, and I get a javascript "error on page" when the button is clicked. Is there any way to use the form variable url instead of the vbscript variable str_url to assign the redirect path? I tried to use formname.url.value but it used the string literally and did not put the value of the variable into the statement. If anyone has any other suggestions that would be great too. I'm sure this is standard stuff for increasing the security of a web page, but I can't seem to find information on exactly this problem.

Thanks

[etylocus]

Can you post the complete html code of your page, so we can reproduce the error? Thx.

[etylocus]

Ahum. I've been taking a closer look to your post, and as you haven't posted the html, i can try to give it a better shot:
The spider is trying to add an alert box to the html, but it probably isn't very good at it, because it's breaking the javascript code.
I think you're getting something like this:

<input type=button name="" value="Click Here"
onclick="location.href='redirect_page.asp'+onmouseover%3dalert(%27spid%27)+" ID="Button1">

In that case, the problem is because the spider adds text after the single quote ('). Try this code and see what happens:

<input type=button name="" value="Click Here" onclick="location.href=<%=str_url%>" ID="Button1">

If this doesn't work, please post as much code as possible.

[vintage_coder]

Hi etylocus,

I did not respond sooner because I was in a class today and will be again tomorrow. I will try your suggestion on Monday and post more code if it does not work. Thanks for your help, I will let you know what happens.

[vintage_coder]

Hi etylocus,

Here is the page that I'm having trouble with. The variable I called str_url is actually called REDIRECT_URL on the page. It's assigned on line 12. The hidden variable is declared on line 96 and the validation routine is called on line 104. Thanks for your help!

[etylocus]

You should had posted as well the HTML that results of loading the page on a browser as well, because i think the problem ocurs after the page is served. Anyway, try this:

First, change the hidden field with the url:
<input type=hidden name="url" id="url" value="<%=REDIRECT_URL%>">
This adds an id to the text field so you can access its value easyly with javascript.

Then add this function to the javascript code:
function redirect()
{
location.href=document.getElementById("url");
}
This functions "wraps" the redirect code so we can use a more clean code in the button (Yeah, i know that's obvious, but...)



Finally, modify the code of the button clicked:
<input type=button name="" value="Click Here" onclick="redirect();" ID="Button1">
This executes the function we added instead of changing the location directly. As a result we can remove the single quotes from the onclick event. Don't forget to add the semi colon at the end. With this, we're setting the field to something the webspider knows so it doesn't breake the code, and you're both happy.
I obviously tried this code and it works, so if it still doesn't work at your side, something else is breaking it.

[vintage_coder]

Hi Etylocus,

Your suggestion worked. Thank you very much for the help. I did have to make one change though, in case anyone else is going to try this. In the javascript function redirect() I had to change the statement to:

location.href=document.getElementById("url").value;

in order for it to work.

[etylocus]

Yuck!
My mistake. My code was right (otherwise i wouldn't had worked on my side) But then i wrongly copy pasted...