trickeries! » xss http://trickeries.com it's tricky to rock a style thats liked online Tue, 02 Mar 2010 06:01:56 +0000 http://wordpress.org/?v=2.9.2 en hourly 1 codeigniter, xss cleaning, and form output http://trickeries.com/391/codeigniter-xss-cleaning-and-form-output/ http://trickeries.com/391/codeigniter-xss-cleaning-and-form-output/#comments Mon, 23 Feb 2009 01:50:42 +0000 atom http://trickeries.com/?p=391 If you are a codeigniter user please use caution when outputting any user input into your views, even after it has been passed through xss_clean, or you have global xss filtering on. This will not prepare output for form field use. In order to safely output user input in a form field, you will need to load the form helper class as well and use the form_prep() function. The form_prep function is not available in the input class.

This is something I have discussed with the codeigniter developers, and they do not feel it is necessary to change:

“All global_xss_filtering does is run the Input::xss_clean() filter on user input for you automatically. It does not make assumptions about where or how that data will be used, and it would be improper to always format the content as needed for use in a form field.”

I do not feel that it is adequately documented that you need to make further alterations to input after the xss_clean, especially when it includes loading a helper file. This is not mentioned in the documentation for the input class.

At first I thought I was making undue assumptions, but a few quick injection attempts on other codeigniter run sites / projects, I realize that I am not the only one assuming.

]]> http://trickeries.com/391/codeigniter-xss-cleaning-and-form-output/feed/ 3 Don’t fool yourself when cleaning input, Javascript is sneaky as hell. http://trickeries.com/98/dont-fool-yourself-when-cleaning-input-javascript-is-sneaky-as-hell/ http://trickeries.com/98/dont-fool-yourself-when-cleaning-input-javascript-is-sneaky-as-hell/#comments Sun, 04 May 2008 07:30:54 +0000 atom http://trickeries.com/?p=98 User input must never be trusted. It is impossible to emphasize this enough. Please excuse me if I get emotional, it is a sensitive subject for me.

All web developers worth anything know this, but very often even the most experienced developer makes assumptions or simple mistakes that leave a dirty little hole which is ripe for pillaging.

I recently found a hole in an application which was caused by lazy / inadequate / ill-conceived input cleansing. The developers have been notified and will surely correct the problem shortly. I will release more detail regarding this when the issue has been resolved and a fix is in place. Of course, if you are a trusted dot-comrade I can fill you in before hand as requested. For everyone else, check out:

]]> http://trickeries.com/98/dont-fool-yourself-when-cleaning-input-javascript-is-sneaky-as-hell/feed/ 0