From e1b29d7c25572dd8c557bfe415880f917fdaae0b Mon Sep 17 00:00:00 2001 From: "Edward Z. Yang" Date: Wed, 8 Nov 2006 01:31:38 +0000 Subject: [PATCH] [1.2.0] XSS attacks smoketest given facelift. git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@516 48356398-32a2-884e-a903-53898d9a118a --- NEWS | 1 + smoketests/xssAttacks.php | 56 +++++++++++++++++++++++++++++++-------- 2 files changed, 46 insertions(+), 11 deletions(-) diff --git a/NEWS b/NEWS index f01b4f67..db4cfcb3 100644 --- a/NEWS +++ b/NEWS @@ -11,6 +11,7 @@ NEWS ( CHANGELOG and HISTORY ) HTMLPurifier 1.2.0, unknown projected release date ! Added MODx plugin ! Added percent encoding normalization +! XSS attacks smoketest given facelift - Documentation updated + TODO added request Phalanger + TODO added request Native compression diff --git a/smoketests/xssAttacks.php b/smoketests/xssAttacks.php index 48d020a1..4fdace29 100644 --- a/smoketests/xssAttacks.php +++ b/smoketests/xssAttacks.php @@ -2,6 +2,19 @@ require_once('common.php'); +function formatCode($string) { + return + str_replace( + array("\t", '»', '\0(null)'), + array('\t', '»', '\0'), + escapeHTML( + str_replace("\0", '\0(null)', + wordwrap($string, 28, " »\n", true) + ) + ) + ); +} + ?> @@ -9,15 +22,26 @@ require_once('common.php'); HTMLPurifier XSS Attacks Smoketest +

HTMLPurifier XSS Attacks Smoketest

XSS attacks are from http://ha.ckers.org/xss.html.

-

The last segment of tests regarding blacklisted websites is not +

Caveats: +The last segment of tests regarding blacklisted websites is not applicable at the moment, but when we add that functionality they'll be -relevant.

-

Most of the XSS broadcasts its presence by spawning an alert dialogue.

+relevant. Most XSS broadcasts its presence by spawning an alert dialogue. +The displayed code is not strictly correct, as linebreaks have been forced for +readability. Linewraps have been marked with ». Some tests are +omitted for your convenience. Not all control characters are displayed.

+

Test

- -
- +
attack as $attack) { $code = $attack->code; + + // custom code for null byte injection tests + if (substr($code, 0, 7) == 'perl -e') { + $code = substr($code, $i=strpos($code, '"')+1, strrpos($code, '"') - $i); + $code = str_replace('\0', "\0", $code); + } + + // disable vectors we cannot test in any meaningful way + if ($code == 'See Below') continue; // event handlers, whitelist defeats + if ($attack->name == 'OBJECT w/Flash 2') continue; // requires ActionScript + if ($attack->name == 'IMG Embedded commands 2') continue; // is an HTTP response + // custom code for US-ASCII, which couldn't be expressed in XML without encoding if ($attack->name == 'US-ASCII encoding') $code = urldecode($code); ?> - + > - + purify($code); ?> - - + + attack as $attack) { ?>
NameRawOutputRender
name); ?>
-
\ No newline at end of file