0

What I mean:

http://kjventura.com/2011/11/make-pretty-urls-with-php-url-routing/

I use this system on my site (development stage). With urls like:

site.com/tag/lorem

as example I have output "lorem" into h1 tag on the webpage.

But how launch simple alert() with this URl scheme? I dont escape anything (deliberately)

5
  • XSS works when user submitted content (be it via URL, GET, POST, COOKIE, from a DB, from an API, whatever) is displayed on the page. In this case, unless you echo out your parts of the URL you are likely OK. Depending on what you do next (e.g. echo file_get_contents($uri[1]);) then you may be vulnerable to directory traversal attacks. Jan 23, 2014 at 20:16
  • Passing a URL-encoded <script> tag on the end of your string to the <h1> will cause it to be decoded and inserted into your HTML, and the browser then executes it. Jan 23, 2014 at 20:19
  • @MichaelBerkowski You should better double check that. Because it won’t be decoded automatically as PHP does with URL parameters.
    – Gumbo
    Jan 23, 2014 at 20:23
  • @Gumbo Ah yes, correct. I didn't read the link (or the title I guess) and assumed $_GET was being rewritten into. Jan 23, 2014 at 20:27
  • So in this use case, via $_SERVER['REQUEST_URI'] it may not be vulnerable, but it is essential to get into the habit of using htmlspecialchars() around user input strings sent back to the browser to mitigate it. Jan 23, 2014 at 20:29

1 Answer 1

0

Since $_SERVER['REQUEST_URI'] contains the unchanged URI as it appeared in the request line, the characters that can get passed depend on what characters are allowed in a URI path, more precisely in a path segment:

segment       = *pchar
pchar         = unreserved / pct-encoded / sub-delims / ":" / "@"

Where pct-encoded is a percent-encoded octet, and unreserved as well as sub-delims are defined as follows:

unreserved  = ALPHA / DIGIT / "-" / "." / "_" / "~"
sub-delims  = "!" / "$" / "&" / "'" / "(" / ")"
            / "*" / "+" / "," / ";" / "="

These allowed characters are not sufficient for a Cross-Site Scripting attack when the injection occurs in the content of an HTML element like in your case a <h1>…</h1>. You would at least need a < to be able to create a start-tag.

However, if you would decode the percent-encoded octets, any character could be passed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.