ModSecurity Blog: XSS Defense HOWTO
ふむふむ、mod_securityでクロスサイトスクリプティングを防ぐための方法を考えると。
Without any planning (so please forgive any omissions), I am now going to write how to produce web applications that are safe against XSS and other injection attacks.
http://blog.modsecurity.org/2008/07/do-you-know-how.html
UTF-8系の話が弱いなぁ。
http://blog.modsecurity.org/2008/07/do-you-know-how.html
- Identify all system components other than the application itself. In a typical web application you will have at least the following:
- Database
- Browser output, which further consists of:
- HTML
- JavaScript
- CSS
- Response headers (e.g. redirection, cookies, etc)
- Adopt one character encoding (use UTF-8 unless you have a good reason not to) and make sure all components are configured to use it:
- Databases typically need to be created with a character encoding in mind
- In the HTML pages you create, set the character encoding explicitly
- Then, for every component:
- Identify safe characters
- Identify how to make unsafe characters safe by converting them into something else
- Write a function that looks at characters one by one to determine if they are safe, and converts those that are not (whitelisting, not blacklisting!)
- Every such function must be aware of the character encoding used in the application
- Then, for every piece of code that sends data from one component into another, make sure you use the correct function to encode data to make it safe
- Check that every piece of data you receive is in the correct character encoding and that the format matches that of the type you are expecting (input validation). You must use whitelisting (as blacklisting does not work). This is especially important for user-supplied Internet addresses see below for details. Before you do anything with the input data make sure to canonicalise it (as suggested by Jim Manico in one of the comments), which will reduce the possibility of evasion through the use of multiple representations of the same character.
