Skip to main content

HTML code injection

Need​

Prevention of HTML code injection and protection against malicious user input

Context​

  • Usage of Ruby for building web applications and scripting
  • Usage of Ruby on Rails for building web applications

Description​

Non compliant code​

class UsersController < ApplicationController
  def update
    @user = User.find(params[:id])
    @user.update_attribute(:name, params[:name])
    redirect_to @user
  end
end

In the above code, we have a UsersController with an update action. This action is vulnerable to HTML code injection because it directly takes user input from the parameters and updates the user's name attribute without any sanitization or validation.

The line of code that makes this possible is:

@user.update_attribute(:name, params[:name])

Here, params[:name] can contain any value that the user sends in the HTTP request, including potentially malicious HTML code. If an attacker sends HTML code as the :name parameter, the code will be saved in the user's name attribute and rendered in the view whenever the user's name is displayed. This could allow the attacker to perform actions on behalf of other users, steal sensitive information, or manipulate the application's appearance.

Steps​

  • Sanitize user input: Implement input validation and filtering to prevent the injection of HTML code.
  • Use appropriate HTML encoding: When displaying user input on the application's views, make sure to properly encode the content to prevent HTML code injection.
  • Implement Content Security Policy (CSP): Configure the application to enforce a strict CSP that restricts the types of content that can be loaded, preventing the execution of injected scripts.
  • Educate developers: Provide training and guidelines to developers on secure coding practices, emphasizing the importance of input validation and output encoding.
  • Regularly update dependencies: Keep the Ruby on Rails framework and its dependencies up to date to benefit from security patches and fixes.
  • Perform security testing: Regularly conduct security assessments, including penetration testing, to identify and address any vulnerabilities in the application.

Compliant code​

class UsersController < ApplicationController
  def update
    @user = User.find(params[:id])
    @user.update_attribute(:name, sanitize(params[:name]))
    redirect_to @user
  end

  private

  def sanitize(input)
    ActionController::Base.helpers.sanitize(input)
  end
end

The updated code now includes a private method sanitize that uses Rails' built-in sanitize helper method to clean the user input before it's saved to the database. This method will strip out any HTML tags from the input, preventing HTML code injection.

In the update method, we now call this sanitize method on params[:name] before passing it to update_attribute. This ensures that any HTML code that a malicious user might have tried to inject will be removed before it's saved.

This is a simple and effective way to prevent HTML code injection in this particular case. However, it's important to note that preventing HTML code injection and other types of injection attacks generally requires a comprehensive approach that includes input validation, output encoding, use of security headers like Content Security Policy, regular updates to dependencies, and ongoing security testing.

References​

Last updated on