Cross-site scripting (XSS) attack, one of the SharePoint Security Series

What is cross-site scripting attack?

==============================

Attackers create a website. When a victim accesses the website, the browser client receives a malicious script.Code. The script code will be run after the victim's browser. because the browser downloads a script from a trusted site, it is impossible for the browser to identify whether the code is legal and Microsoft IE security zone cannot provide protection. this attack can be performed over HTTP and HTTPS connections.

One of the most serious examples of cross-site scripting attack is that when attackers write scripts to obtain the authentication cookie that can provide access permissions to a site, then, the cookie is sent to a Web address known to the attacker. this allows attackers to pretend to be legitimate users for illegal access to the site.

 

Vulnerabilities that make your web application vulnerable to Cross-Site Script attacks include:

• There are no restrictions on user input and Verification
• No encode for output
• Trust the data obtained from a shared database

 

Countermeasures

There are two important countermeasures

1. Restrict input (constrain input ).

2. encode the output.

 

HTML encode replaces characters with special meanings of HTML to variables that represent these special characters. For example<Replaced& Lt;For example"Replaced& Quot ;.

The data generated by encod does not cause the browser to execute code. Instead, these characters are only displayed as harmless HTML characters.

 

For more information about how to apply in common Asp.net applicationsProgramFor how to: prevent cross-site scripting in ASP. NET ).

 

SharePoint 1, 2010

==============================

For SharePoint 2010, Sharepoint itself provides defense measures against such attacks. for developers, there are some important points to be aware.

• Encode output properly using sphttputility Methods
• Never allow contributor users to add script to the site
• Always set a charset in the Content-Type HTTP Response Header
• Do not allow user provided values in style and event attributes

 

For more details, see section on Cross-Site Scripting in security best practices for developers in SharePoint 2010.

 

References

Security best practices for developers in SharePoint 2010

Http://msdn.microsoft.com/en-us/library/gg552614.aspx

How to: prevent cross-site scripting in ASP. NET

Http://msdn.microsoft.com/en-us/library/ff649310.aspx