Welcome! » Log In » Create A New Profile

<BASE HREF="javascript:alert('XSS');//"> is returned instead of being removed

Posted by cms-4-all.com 
Forum List Message List New Topic
cms-4-all.com
<BASE HREF="javascript:alert('XSS');//"> is returned instead of being removed
February 16, 2012 11:47AM

Hi,

I am using CKeditor (http://ckeditor.com/) and HTML Purifier in my site. After the setup, I had been performing some random checking with the XSS code being available in the smoke test.

By entering the following into the editor: < BASE HREF="javascript:alert('XSS');//" >

The editor return the following text which was safely passing the HTML Purifier checking: &lt BASE HREF="javascript:alert('XSS');//" &gt (please add ; followed by both &lt and &gt as end result as I am unable to display the actual HTML coding without being converted into < and > respectively in this forum)

HTML Purifier doesn't clean the script because the < and > had been changed to &lt and &gt (again, pls add in ; for both).

I would like to ensure that the HTML Purifier will remove the entire script. How could i go around with it?

Please advise. Thanks in advanced!

Reply Quote
Ambush Commander
Re: &lt;BASE HREF="javascript:alert('XSS');//"&gt; is returned instead of being removed
February 16, 2012 12:06PM

Decode the text before passing it to HTML Purifier.

Reply Quote
cms-4-all.com
Re: &lt;BASE HREF="javascript:alert('XSS');//"&gt; is returned instead of being removed
February 16, 2012 09:58PM

Thanks Ambush Commander! It's works like charm! Nice day! ^^

Reply Quote
Newer Topic Older Topic
Author:
Your Email:

Subject:

HTML input is enabled. Make sure you escape all HTML and angled brackets with &lt; and &gt;.

Auto-paragraphing is enabled. Double newlines will be converted to paragraphs; for single newlines, use the pre tag.

Allowed tags: a, abbr, acronym, b, blockquote, caption, cite, code, dd, del, dfn, div, dl, dt, em, i, ins, kbd, li, ol, p, pre, s, strike, strong, sub, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, var.

For inputting literal code such as HTML and PHP for display, use CDATA tags to auto-escape your angled brackets, and pre to preserve newlines: 

<pre><![CDATA[
Place code here
]]></pre>

Power users, you can hide this notice with: 

.htmlpurifier-help {display:none;}

Message: