Prevent Javascript in URL attacks (asp.net)

Question

I've seen plenty of Cross-Site Scripting attack prevention suggestions, but I'm not asking about Form Input validation. How would I prevent something like this:

javascript:(function(i,j){with(document){for(i=0;i<forms.length;++i){with(forms[i]){for(j=0;j<elements.length;++j){elements[j].disabled=false}}}}})()

from being inserted into the URL? This code would enable all form elements on a page if added to a URL. So if you disabled certain buttons based due to permissions or something then all those buttons would become enabled.

Should I just be parsing the URL and check for the Javascript keyword?

Noon Silk · Accepted Answer · 2009-08-31 23:56:25Z

3

No. You can't, anyway, as it doesn't get sent to the server.

That is just JavaScript executed locally by the user themselves. It should mean nothing to you. The security of your system should never rely on client-side javascript, all your authentication, and so on, should be done server-side.

answered Aug 31, 2009 at 23:56

Noon Silk

55.4k6 gold badges91 silver badges105 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Drakarian Over a year ago

Yeah after thinking about it a bit more I came to the same conclusion. The site is not doing a postback so no way to validate the URL.

D'Arcy Rittich · Accepted Answer · 2009-08-31 23:58:32Z

0

The key is to not worry much about it client-side. Server-side is where you have to be bullet-proof. Do not assume, for example, that just because you named your form inputs the same as your database column names, that you can just loop through Request.Form and persist all the data you get. You should validate that you only process the inputs you are expecting, and validate them for data type and range, as well as considering the user's permissions to alter a given field.

That way, the user can send whatever they want, you will only process and accept valid data server-side.

answered Aug 31, 2009 at 23:58

D'Arcy Rittich

172k41 gold badges298 silver badges287 bronze badges

Collectives™ on Stack Overflow

Prevent Javascript in URL attacks (asp.net)

2 Answers 2

1 Comment

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Related