Javascript DOM based XSS vulnerability

Finding Type: DOM based Cross-Site Scripting (XSS)
Information
The potentially vulnerable code was found on url 'https://www.spletnastran.si/iskalnik#re.... An attacker may be able to inject JavaScript using the the code 'location.href' at line 375:23 and control its display using the code 'window.location' at line 375:16

Risk 6.1 Description
DOM based Cross-Site Scripting (XSS) allows an attacker to send malicious code to a different user by modifying the DOM environment in the browser of the user.

function JustABC_validation($str) { 
	// $str = stringToReplace.replace('/[^a-zA-Z0-9]/gi', ''); 
	$sub_string = preg_replace("/^([^a-zA-Z0-9])*/", "", $str,1);
	$sub_string = strrev(preg_replace("/^([^a-zA-Z0-9])*/", "",strrev($sub_string),1));
	return $sub_string;
} 

Spura je 10. feb 2020 ob 14:21 izjavil:

Najlazji nacin da zatres XSS je da uporabis Content-Security-Policy header, ki izklopi vse inline JS skripte razen tvojih. Tele PHP fore z replaceom posebnih znakov pri webu in SQLu so zastarele.

add_header Content-Security-Policy "default-src 'self'" always;

add_header X-Frame-Options "deny" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Content-Security-Policy "default-src 'self'" always;

Joze_K je 10. feb 2020 ob 08:04 izjavil:

problem poskušam rešiti kar v 4 korakih:
1) $query = JustABC_validation($_POST["query"]);

function JustABC_validation($str) { 
 // $str = stringToReplace.replace('/[^a-zA-Z0-9]/gi', ''); 
 $sub_string = preg_replace("/^([^a-zA-Z0-9])*/", "", $str,1);
 $sub_string = strrev(preg_replace("/^([^a-zA-Z0-9])*/", "",strrev($sub_string),1));
 return $sub_string;
 } 

2) $query = str_ireplace("javascript", "", $query);
3) $query = str_ireplace("script", "", $query);
4) $query = htmlspecialchars($query);

crashtest še dalje javlja to napako

očitno je moje razmišljanje o smeri reševanja te napake nepravilno.. a zna kdo predlagati rešitev tega problema

MrStein je 13. feb 2020 ob 18:46 izjavil:

A $query sploh kje uporabiš?

$sql = "SELECT * FROM " . $tabel . " WHERE 
(`Ime` LIKE '%".htmlspecialchars($query)."%')"; 

MrStein je 13. feb 2020 ob 18:46 izjavil:

Joze_K je 12. feb 2020 ob 13:02 izjavil:

 
 .... nekako tako...

A $query sploh kje uporabiš?

Spura je 12. feb 2020 ob 14:09 izjavil:

MrStein je 12. feb 2020 ob 10:11 izjavil:

Funkcionalnost headerja X-Frame-Options je že vključena v CSP header, tako da je bolje samo tega uporabiti (Content-Security-Policy)

Spura je 11. feb 2020 ob 01:53 izjavil:

ce imas "default-src 'self'" in pa "frame-ancestors 'none'" potem so XSS napadi nemogoci

To niti teoretično ni res.
Popravek: to dejansko blokira veliko večino XSS

Zanima me, katerih to ne blokira.

Recimo <script src='isti URL kot base/xyz'/>