0

I have built an inframe editor from scratch. I am trying it for XSS vulnerability. The iframe is described as:

<iframe   id="wysiwygtextfield" onload="return initialize(this);"  frameborder="0"  scrolling="no" >
                 <html>
                      <head>
                      </head>
                 <body spellcheck = "true">
                      <br/>
                 </body>
                 </html>
<iframe>

I try copy pasting the following vector:

<SCRIPT SRC=//ha.ckers.org/.j>

And it executes. I have a event trigger on the copy paste event which is like this:

    $('#wysiwygtextfield').contents().find('body').bind("paste", function(e) {

        var element = this;
         setTimeout(function(){
        var text = $(element).text() ;
      /*  var pattern = /<script(\s+(\w+\s*=\s*("|').*?\3)\s*)*\s*(\/>|>.*?<\/script\s*>)/;

        text = text.toLowerCase().replace(pattern,"Dirty paste") ; */
    $('#wysiwygtextfield').contents().find('img').each(
                                                    function()
                               { text += "<br/><br/>"+ $(this).get(0).outerHTML ; }
);

        $(element).html(text) ; },10);

    }); 

I tried using a regular expression match to counter it, but it is not effective (more of a black list). I tried some of the other text editors out there (ckeditor and tinymce) and they simply copy paste the text without the javascript getting executed. Is there any other way to safely copy paste the javascript without executing? I have a sanitizer on the server side to remove the markup.

1 Answer 1

0

you should validate the content at server side. Also for HTML regular expression is not a good practice. you can use HTMLAgilityPack library which provides very nice features for HTML parsing at serer side.

if you still want to do stuff on client side you can do it as below

$('#wysiwygtextfield').contents().find('body').bind("paste", function(e) {

        var element = this;
         setTimeout(function(){
        $(element).find("script").remove();        //this would remove all script tags from html

//or you can replace the script tag with something else
$(element).find("script").replaceWith("<div>Dirty Paste</div>");


        $('#wysiwygtextfield').contents().find('img').each(
                                                    function()
                               { text += "<br/><br/>"+ $(this).get(0).outerHTML ; }
);

        $(element).html(text) ; },10);

    }); 
1
  • I am finally clearing it on the server side. But afraid of any exploits if the script executes on the client side.
    – Varun Jain
    Sep 24, 2013 at 13:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.