Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I wonder if href and src attributes on <a> and <img> tags are always safe w.r.t. XSS attacks, if they start with http:// or https://.

For example, is it possible to append javascript: ... to the href and src attribute in some manner, to execute code?

Disregarding whether or not the destination page is e.g. a pishing site, or the <img src=...> triggers a terribly troublesome HTTP GET request.

Background: I'm processing text with markdown, and then I sanitize the resulting HTML (using Google Caja's JsHtmlSanitizer). Some sample code in Google Caja assumes all hrefs and srcs that start with http:// or https:// are safe -- I wonder if it's safe to use that sample code.

Kind regards,
Kaj-Magnus

share|improve this question
1  
You shouldn't be using only an HTML sanitizer. They can be easily bypassed and should only be used for convenience when used in conjunction with a server side solution. HTML Purifier is a good example of that. –  John Conde Mar 30 '11 at 13:38
    
Actually, I run JsHtmlSanitizer on both the client and server. On the server I using the Rhino JavaScript engine. I just read about HTML Purifier and I got the impression that running JsHtmlSanitizer on the server would do roughly the same thing, as HTML Purifier? Except for the fact that JsHtmlSanitizer only sanitizes, doesn't purify. (Thanks for the tip :-)) –  KajMagnus Mar 30 '11 at 14:35
add comment

1 Answer 1

up vote 3 down vote accepted

Allowing only the http(s) protocol prevents running javascript, but they can still be used for malicious purposes. Consider the following:

<img src="http://your.website.com/changepassword.php?newpass=hacked123" />

Allowing users to embed content from external websites is always risky, but sometimes inevitable. Making sure your scripts are well protected against XSS like the one above will make your site more solid, if not 100% hacker proof.

EDIT: Here's a pretty comprehensive XSS cheat sheet, though a bit aged. One important point taken from the cheat sheet that I forgot to mention is that you should also escape quotes and/or > signs to prevent URLs such as http://legiturl.com"><script src="http://mal.icio.us/attack.js">.

share|improve this answer
    
"Allowing only the http(s) protocol prevents running javascript" - do you have a source for that? –  Jo Liss Jun 20 '12 at 12:30
    
@JoLiss: Sorry for the poor choice of words, I meant that allowing only the http(s) protocol in the URL prevents embedding javascript in the URL itself. –  Kaivosukeltaja Jun 27 '12 at 18:22
    
Right, that's what I understood. It seems very reasonable, but do you have an actual source for that? I wouldn't want to filter by /^https?:\/\//, only to discover later that there's some obscure URI feature I didn't know about. –  Jo Liss Jun 27 '12 at 20:37
    
@JoLiss: I found a quite good source and edited it into my post. It's mainly for older browsers but many of the points are still valid. –  Kaivosukeltaja Jun 28 '12 at 14:38
    
That's a great source, thanks! –  Jo Liss Jun 28 '12 at 15:05
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.