如何在不暴露 XSS 漏洞的情况下安全地从客户端发送电子邮件？

Question

We have a business application that can be considered legacy. As a part of this application, users can send a mail to their clients with one of our business e-mail accounts. The mail content is sent as html directly to the server, and sanitized using a white list.

However, our client wishes to install a WAF which blocks almost all of the html tags from reaching the server. This means that even if we were to encode the files, tags such as br, b or img get blocked. After a lot of back end forth, it was ultimately left to us to circumvent this issue. How can we alter this system so that it does not use html tags, even in encoded forms? The WAF blocks even the lt gt forms of these.

For reference, we use java 8 with javascript 1.7.

Answer 1

Use AWS WAF V2 and define the desired WAF rules with the rule builder wizard. The text transformations rule statement (eg. HTML entity decode) has nothing to do with the cross-site scripting attack rule statement. Tearing down security measures is generally not suggested, while not know what one is actually doing. Using two separate hostnames might make it easier to tell apart these requests, in order to apply two different rule sets; see how labeling works .

I mean, you could remove that HTML entity white list from the application and then declare it as a WAF rule statement instead - then WAF would sanitize the request, before it even hits the server. It is pointless to install WAF, but then not to configure and use it.