Skip to main content

Server side cross-site scripting

Need​

Prevention of server-side cross-site scripting attacks

Context​

  • Usage of Go 1.16 for building high-performance and scalable applications
  • Usage of Gin for building web applications in Go
  • Usage of net/http for creating HTTP servers in a Node.js application

Description​

Non compliant code​

package main

import (
	"github.com/gin-gonic/gin"
	"net/http"
)

func main() {
	r := gin.Default()

	r.GET("/user/:name", func(c *gin.Context) {
		name := c.Param("name")
		c.String(http.StatusOK, "Hello %s", name)
	})

	r.Run()
}

The above code is a simple Gin application in Go that has an endpoint /user/:name. This endpoint takes a parameter name from the URL and returns a message "Hello name".

The vulnerability here is in the line c.String(http.StatusOK, "Hello %s", name). The name parameter is directly taken from the URL parameter without any sanitization or encoding. This allows for a potential Server-Side Cross-Site Scripting (XSS) attack where an attacker could inject JavaScript code as the name parameter.

For example, an attacker could make a request with the URL /user/<script>malicious_code_here</script>. The server would then execute the malicious JavaScript code before rendering the user input. This could potentially compromise internal server files, make requests on behalf of the server, or perform a port scan.

To fix this vulnerability, the application must sanitize and encode all user inputs before using them. This ensures that any malicious code injected by an attacker is treated as plain text and not executed by the server.

Steps​

  • Sanitize user input: Implement input validation and filtering to remove any potentially malicious characters or scripts.
  • Use context-aware output encoding: Encode user input before rendering it in the response to prevent the execution of any injected scripts.
  • Implement Content Security Policy (CSP): Set a strict CSP header to restrict the types of content that can be loaded by the browser, preventing the execution of injected scripts.
  • Enable XSS protection mechanisms: Enable built-in XSS protection mechanisms provided by the framework or web server to automatically detect and block potential XSS attacks.
  • Regularly update dependencies: Keep all dependencies, including the Gin framework, up to date to ensure that any security vulnerabilities are patched.
  • Educate developers: Provide training and guidelines to developers on secure coding practices, including input validation and output encoding, to prevent XSS vulnerabilities.

Compliant code​

package main

import (
	"github.com/gin-gonic/gin"
	"github.com/microcosm-cc/bluemonday"
	"net/http"
)

func main() {
	r := gin.Default()
	p := bluemonday.UGCPolicy()

	r.GET("/user/:name", func(c *gin.Context) {
		name := c.Param("name")
		safeName := p.Sanitize(name)
		c.String(http.StatusOK, "Hello %s", safeName)
	})

	r.Run()
}

The updated code now includes the bluemonday package, which is a HTML sanitizer written in Go. It's used to sanitize the user input and prevent Cross-Site Scripting (XSS) attacks.

In the main function, we create a new bluemonday policy with bluemonday.UGCPolicy(). This policy allows elements that are safe for user generated content.

When handling the GET request, we now sanitize the user input with p.Sanitize(name). This removes any potentially harmful scripts from the input before it's used in the response.

This way, even if a user tries to inject JavaScript code into the name parameter, the sanitizer will remove it and prevent the server from executing any malicious scripts. This effectively mitigates the server-side XSS vulnerability in the application.

Remember to run go get github.com/microcosm-cc/bluemonday to fetch the bluemonday package before running the application.

In addition to this, it's recommended to implement a Content Security Policy (CSP) to restrict the types of content that can be loaded by the browser, and to enable any built-in XSS protection mechanisms provided by the framework or web server. Regularly updating all dependencies and educating developers about secure coding practices are also crucial steps in preventing XSS vulnerabilities.

References​

Last updated on