I tried creating a node with XSS in the title, body, and a cck text field. These were all accepted and since I had a purposely vulnerable module on my site were printed back to me.

Does this module prevent persistent XSS or reflected? both? neither?

Comments

greggles’s picture

greggles
he/him
Primary language English
Location Denver, Colorado, USA
commented
Title: Doesn't filter node bodies? » Doesn't filter node bodies, titles, or cck fields?

Updated title since I tried a few more things after writing it.

dave reid’s picture

dave reid
he/him
Primary language English
Location Nebraska USA
commented
Title: Doesn't filter node bodies, titles, or cck fields? » Doesn't filter node bodies?

I don't see how this actually prevents any XSS at all.

dave reid’s picture

dave reid
he/him
Primary language English
Location Nebraska USA
commented
Title: Doesn't filter node bodies? » Doesn't filter node bodies, titles, or cck fields?
sudeepg’s picture

sudeepg commented

Hi David,

Thanks for testing the module.

Lot of XSS attacks happen due to script tags being put up in the URL and to execute them hackers use '<', '>' to enclose tags. We did some extensive testing on few of our production sites using some renowned XSS scanners and it was difficult to plug them all. This simple fix plugged all attacks and it has been months we have seen any XSS alert on any of them.

I hope this information helps.

Thanks,
Sudeep

sudeepg’s picture

sudeepg commented

This module is not a replacement for check_plain which is intended to be used wherever possible in open drupal forms, but a generic url filter to avoid hackers from exploiting URLs. So, we are trying to sanitize cross-site suspicious GET requests here.

greggles’s picture

greggles
he/him
Primary language English
Location Denver, Colorado, USA
commented
Title: Doesn't filter node bodies, titles, or cck fields? » Document what kinds of XSS this blocks
Component: Code » Documentation
Category: bug » task

So it's for reflected XSS. It would be great if you could state that more clearly on the project page.

sudeepg’s picture

sudeepg commented
Status: Active » Closed (fixed)

I will do that. Thanks for providing feedback. I mark this item closed now.

tim.plunkett’s picture

tim.plunkett
he/him
Primary language English
Location Philadelphia
commented
Status: Closed (fixed) » Fixed

Set to "fixed", not "closed (fixed)". http://drupal.org/node/156119#closed

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.