1
0
mirror of https://github.com/danog/psalm.git synced 2024-12-12 17:27:28 +01:00
psalm/docs/running_psalm/issues/TaintedHtml.md
2021-08-05 16:39:14 -04:00

1.4 KiB

TaintedHtml

Emitted when user-controlled input that can contain HTML can be passed into to an echo statement.

Risk

This could lead to a potential Cross Site Scripting (XSS) vulnerability. Using a XSS vulnerability, an attacker could inject malicious JavaScript and execute any action JavaScript could do. Examples include:

  • Stealing authentication material (e.g. cookies, JWT tokens)
  • Exfiltrate sensitive information by reading the DOM
  • Keylog entries on the website (e.g. fake login form)

Whether this is exploitable or not depends on a few conditions:

  • Is an executable mimetype set? (e.g. text/html)
  • Is the content served inline or as attachment? (Content-Disposition)
  • Is the output properly sanitized? (e.g. stripping all HTML tags or having an allowlist of allowed characters)

Example

<?php

$name = $_GET["name"];

printName($name);

function printName(string $name) {
    echo $name;
}

Mitigations

  • Sanitize user-input by using functions such as htmlentities or use an allowlist.
  • Set all cookies to HTTPOnly.
  • Consider using Content Security Policy (CSP), to limit the risk of XSS vulnerabilities.

Further resources