How to use ESAPI to resolve JavaScript DOM XSS?

Question

We are using HP fortify Audit Workbench 3.80 to assess vulnerabilities in our applications. Fortify marks the the following ExtJs JavaScript code as a Critical (the "worst") DOM XSS vulnerability:

function doAjaxCall(param1, param2, div) {
    var options = {
            url : url,
            params : {
                param1 : param1,
                param2 : param2
            },
            method: 'GET',
            success: function(response, options) {
                processResponse(response, div);
            },
            failure: function(response, options) {
                doSomethingElse();
            }
    };
    Ext.Ajax.request(options);
}


function processResponse(response, div) {
     // SECURITY ISSUE HERE
     document.getElementById(div).innerHTML = '<br>' +
            'An error occurred with status code ' 
             + response.status + 
             '<br><br>';  
}

response is the response returned from an AJAX request.

Fortify says :

method "processResponse" sends unvalidated data to a web browser on line 100, which can result in the browser executing malicious code.

I understand the issue and why it is an issue. What I do not know is how to sanitize the input with ESAPI. We are using ESAPI successfully for issues in our Java code, but I am not sure to resolve this specific issue in JavaScript.

I did find this JavaScript ESAPI library, ESAPI4JS, but I work in an extremely high security environment, and I do not have access to this library whatsoever.

How can I use ESAPI to sanitize the response?

EDIT

Added full ajax request code per user request.

@GeorgeStocker processResponse exists on the client side. It is javascript function containing the line of code I included in the question. — Josh
– Josh, Commented Jan 29, 2015 at 16:54
@GeorgeStocker It is just a wrapper function for the AJAX success callback. — Josh
– Josh, Commented Jan 29, 2015 at 17:06
You may want to include that in the code itself to give a clearer picture of what we're seeing. — George Stocker
– George Stocker, Commented Jan 29, 2015 at 17:15
@GeorgeStocker It truly is just a wrapper. I have added the code anyway. — Josh
– Josh, Commented Jan 29, 2015 at 18:08

Gad D Lord · Accepted Answer · 2025-02-02 17:26:02Z

0

Check the Snyk example at https://learn.snyk.io/lesson/dom-based-xss/ where they provide an example in the form of:

var ESAPI = require('node-esapi');
document.body.style.color =
  'url(<%=ESAPI.encoder().encodeForJS(ESAPI.encoder().encodeForURL(color))%>)';

answered Feb 2 at 17:26

Gad D Lord

6,80212 gold badges64 silver badges113 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

ey3 · Accepted Answer · 2015-01-29 17:02:50Z

-2

Vulnerable:

document.write("Site is at: " + document.location + ".");

Not vulnerable: org.owasp.esapi.ESAPI.initialize(); document.write($ESAPI.encoder().encodeForHTML("Site is at: "+document.location));

You will need to initialize it before use. There is documentation on owasp's site.

@GeorgeStocker is wrong. A dom based xss typically is most dangerous because it cannot be handled server side. A perfect example would be the above which could easily be exploited by using a # before some code.

Also most client side xss filters can be bypassed by using onerror.

ey3

edited Jan 29, 2015 at 17:02

answered Jan 29, 2015 at 16:57

ey3

12 bronze badges

3 Comments

Josh Over a year ago

I think that code is from ESAPI4JS, is it not? I do not have access to that library.

George Stocker Over a year ago

I didn't read that it was 'document.location'; that makes sense.

George Stocker Over a year ago

@JOsh If that Library has the right license (like MIT), you could potentially include the source in your app inline.

Collectives™ on Stack Overflow

How to use ESAPI to resolve JavaScript DOM XSS?

2 Answers 2

Comments

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related