Practices on filtering user inputs

Question

I would like to ask some suggestions from the more experienced people out there. I have to filter the inputs the user wherein the they might try to input values like

<script type="text/javascript">alert(12);</script>

on the textbox. I would like to ask if do you have any recommendations for good practices regarding this issue?

Recently we encountered a problem actually on one of our sharepoint projects. We tried to input a script on the textbox and boom the page crashes... I mean trapping it can be easy I think because we know that it is one of the possible inputs of the user but how about the things that we don't know? There might be some other situations that we haven't considered aside from just trapping a script. Can somebody suggest a good practice regarding this matter?

Thanks in advance! :)

Answer 1

Microsoft actually produce an anti-cross site scripting library, though when I looked at it, it was litte more than a wrapper round various encoding functions in the .NET framework. AntiXSS library

Two of the main threats you should consider are:

• Script injection
• HTML tag injection

Both of these can be mitigated (to a degree) by HTML encoding user input before re=rendering it on the page.

There is also a library called AntiSamy available from the OWASP project, designed to neuter malicious input in web applications.

Answer 2

Jimmy answer is a good technique to manage "Input Validation & Representation" problems.

But you can filter your textbox inputs by yourself before passing it to third party API such AntiSamy and so on.

I generally use these controls:

1) minimize the length of the textbox value: not only in the client side but in the server side too (you couldn't believe me but there aren't buffer overflow attacks also in scripting)

2) Apply a Whitelist control to the characters the users write into the textbox (clientside and Serverside)

3) Use Whitelist if possibile. Blacklist are less secure than Whitelist

It is very important you do these controls into the server side part.

Sure it's very easy to forget some controls and so AntiSamy and products like this are very useful. But I advise you to implement your personal "Input Validation" API.

Securing software is not to get some third party product but it is to program in a different way.

Answer 3

I have tried this on sharepoint with both a single line of text and multiple lines of text, and in both cases sharepoint encodes the value. (i get no alert)

What SharePoint are you using?