RE: A technique to mitigate cookie-stealing XSS attacks

From: jasonk (jasonkat_private)
Date: Tue Nov 12 2002 - 02:43:34 PST

  • Next message: Andreas Pour: "KDE Security Advisory: rlogin.protocol and telnet.protocol URL KIO Vulnerability" 

    > -----Original Message-----
> From: Ulf Harnhammar [mailto:ulfhat_private]
> Sent: Sunday, 10 November 2002 2:22 PM
> To: Justin King
> Subject: Re: A technique to mitigate cookie-stealing XSS attacks
> 
> On Thu, 7 Nov 2002, Justin King wrote:
> 
> > I would be very interested in major browsers supporting a <dead> tag
> with an
> > optional parameter to be a hash of the data between the opening and
> closing
> > dead tag. This tag would indicate that no "live" elements of HTML be
> > supported (e.g., JavaScript, VBScript, embed, object).
> 
> I'm not sure if that's the best solution. Lots of code out there do
much
> less filtering than it should, so there will probably be a way to
include
> a </dead> tag and then use all the usual XSS tricks.

I'm not sure it's the best solution either: how many of you have used
code such as <a href='javascript:...'> and so on ?

It's not going to be as easy as it looks - of course if you don't use
javascript AT ALL then sure, but many sites use javascript rollovers and
so on.  We need a more effective response than this.  Since javascript
(and other client side scripting technologies) are becoming more popular
and functional, it seems like imho the 'best' alternative is the
cookie-blocking approach.  This would stop the *effect* of XSS, much the
same as blocking user privileges doesn't stop them running malware but
prevents them from having an effect.

jasonk

> // Ulf Harnhammar
>    VSU Security
>    ulfhat_private

    This archive was generated by hypermail 2b30 : Tue Nov 12 2002 - 13:14:07 PST