1

I have an XSLT stylesheet that processes an XML document to produce HTML.

I've realised that it's possible to manipulate the site in such a way that the user can supply whatever XML they like - unfortunately this is unavoidable, and so I would like to protect myself from XSS (and other attacks) by ensuring that my XSLT stylesheet is capable of safely processing any document.

What do I need to be aware of to achieve this?

UPDATE:

I know that by default XSLT escapes output (which can be disabled by using the disable-output-escaping attribute) - is this enough to prevent someone from being able to inject malicious HTML elements and attributes?

12
  • Could you explain why you allow users to supply custom xml documents? Could you force validation using a schema to avoid any problems?
    – sisve
    Jan 30, 2011 at 9:13
  • @Simon The XML document is a SQL query execution plan - they aren't allowed to supply it but its simple enough to construct a query (its for the data explorer) that contains an xml document that is treated as an execution plan - I can't think of way to prevent this from happening. There is already a schema, but I'm unsure as to how validating against this schema will help prevent attacks?
    – Justin
    Jan 30, 2011 at 9:32
  • This is not an XSLT question -- retagged. Jan 30, 2011 at 14:48
  • @Dimitre I need my XSLT to safely process an input document, and so I'm pretty sure that any changes are going to have to be made in my XSLT. If you know of an alternative then let me know :-)
    – Justin
    Jan 30, 2011 at 22:13
  • 1
    @dim in cases of edit conflicts we recommend deferring to the question owner unless there is active harm to the community which I do not see here. Jan 31, 2011 at 11:27

1 Answer 1

2

If you are processing XML data from an untrusted source and displaying the result on your website, always remember that it is not to be trusted.

  • You should never use xsl:copy or xsl:copy-of. If you copy nodes other than text directly, XSS attacks will be possible.
  • You should not use complicated or recursive rules. Specially crafted input can create a DoS by delaying the XSLT processing or making the processor crash.
  • Also, like you mentioned, do not disable output escaping.

If you are passing the result of the transformation to an SQL server, you should not put any of the provided data in your SQL query.

For example, this is BAD:

<xsl:if test="@order">ORDER BY <xsl:value-of select="@order"/></xsl:test>

This is GOOD:

<xsl:if test="@order">ORDER BY
    <xsl:chose><xsl:when test="@order = 'foo'">foo</xsl:when> [...] </xsl:chose>
</xsl:test>

If you really need to pass data to your query, use bind variables.

2
  • 1
    Also check your XML input against a schema for errors. If you don't get bad data into the system you're less likely to have to deal with bad data coming out. Jan 31, 2011 at 2:50
  • @Yzmir Ramirez is right. You should first validate the input source, and you could even validate the input source with XSLT 2.0 stylesheets. That was the whole reason for validation.
    – user357812
    Jan 31, 2011 at 17:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.