2021-06-10 23:43:04 +02:00
# TaintedTextWithQuotes
2023-11-22 11:10:23 +01:00
Emitted when user-controlled input that can contain quotation marks can be passed into an `echo` statement.
2021-06-10 23:43:04 +02:00
## Risk
This could lead to a potential Cross Site Scripting (XSS) vulnerability. Using a XSS vulnerability, an attacker could inject malicious JavaScript and execute any action JavaScript could do. Examples include:
- Stealing authentication material (e.g. cookies, JWT tokens)
- Exfiltrate sensitive information by reading the DOM
- Keylog entries on the website (e.g. fake login form)
2021-08-05 22:39:01 +02:00
Whether this is exploitable or not depends on a few conditions:
2021-06-10 23:43:04 +02:00
- Is an executable mimetype set? (e.g. `text/html` )
- Is the content served inline or as attachment? (`Content-Disposition`)
- Is the output properly sanitized? (e.g. stripping all HTML tags or having an allowlist of allowed characters)
## Example
```php
< ?php
2021-06-11 04:18:18 +02:00
$param = strip_tags($_GET['param']);
2021-06-10 23:43:04 +02:00
?>
< script >
console.log('<?=$param?> ')
< / script >
```
2022-08-20 23:29:03 +02:00
Passing `');alert('injection');//` as a `GET` param here would cause the `alert` to trigger.
2021-06-10 23:43:04 +02:00
## Mitigations
2021-06-10 23:55:07 +02:00
- Sanitize user input by using functions such as `htmlentities` with the `ENT_QUOTES` flag or use an allowlist.
2021-06-10 23:43:04 +02:00
- Set all cookies to `HTTPOnly` .
- Consider using Content Security Policy (CSP), to limit the risk of XSS vulnerabilities.
2023-05-12 20:02:13 +02:00
- If user input itself is HTML, see [Sanitizing HTML User Input ](../../security_analysis/avoiding_false_positives.md#sanitizing-html-user-input )
2021-06-10 23:43:04 +02:00
## Further resources
- [OWASP Wiki for Cross Site Scripting (XSS) ](https://owasp.org/www-community/attacks/xss/ )
- [Content-Security-Policy - Web Fundamentals ](https://developers.google.com/web/fundamentals/security/csp )