Manager's Choice Still Active Discussions (4) New Discussions (4) | Hello Everyone, I am PHP Developer and working on a ineranet-based project , can you tell me how many ways javascript injection problem can effect my system. | 8 comments » | Started by Mohd. Tabrez Ansari, PHP Software Developer at Itemperance | | I'll try to provide a simple answer.
Let's say a user on your system found a way to place javascript on your page which is displayed to other users. Once that happens attacker would do the following:
Redirect user to his own site through a frame located on his server.
Your user might still think he is on your domain, but in fact ALL the traffic coming and going is routed through "evil site". Even though URL of the site remains the same. More importantly attacker can gain access over user's keyboard, track mouse movements.
Even if user clicks from your site to paypal.com - it might still be handled through attacker who can then collect user's paypal password. The browser URL would not change and SSL wouldn't be launched, but most users wouldn't notice that anyway.
JavaScript injection is actually a quite scary security vulnerability. If user can inject JS into contact form, which you would open in your admin-pannel and execute JavaScript, your cookies are gone and attacker can instantly get access to manager's console too.
Symfony alone will not help. Using proper techniques will. If you rely on URL Routing, ORM and Template engine should help in most cases. Frameworks provide ways to do this securely, but some developer can always leave a shell:
echo "No search results found for ".$_GET['q'];
If you ask developer, why he left it, he'd say - "it was faster to write this way". The best solution is base best practices on simple practices which are also secure.
http://demo.atk4.com/demo.html?t=11 - injection protection "by default". By Romans Malinovskis, Lead Developer of Agile Toolkit | Job Discussions (18) Don't want to receive email notifications? Adjust your message settings. Stop inappropriate content the moment it is posted. Send me an email for each new discussion » Do you know anybody that might like this group? Invite others to join » LinkedIn values your privacy. At no time has LinkedIn made your email address available to any other LinkedIn user without your permission. © 2011, LinkedIn Corporation. |
No comments:
Post a Comment