angularjs prevent XSS attacks

Question

What's the best way to prevent XSS attacks in an angularjs app? I've used $sanitize before sending it to a rest service call and I'm still getting errors from our security team that the app isnt secure. The call is something along the lines of

http://somesite.com/search?dateFrom='%22()%26%25<acx><ScRiPt%20>prompt(961193)</ScRiPt>&dateTo=20141231&code=5900

But this is suppose to be a POST call. Im not sure why the security scan is still producing errors. Is this something that must be fixed server side? I have a validation in my input fields using directives to prevent users from inputting invalid characters like < , > etc. So I have no clue as to how the scan is producing those errors...

Heres a sample of what the scan response headers

It may be a POST request but your security team may be upset because it's also sending a query string with a nested script tag in it. — War10ck
– War10ck, Commented Oct 6, 2015 at 20:35

Dragos Rusu · Accepted Answer · 2015-10-06 20:48:48Z

4

By definition, XSS fixes are strictly referring to the output of insecure content.

AngularJS would output by default encoded HTML, so it won't be parsed - same goes for JS associated with it. So by default you should be covered.

Still, some AngularJS devs choose to use "ng-bind-html-unsafe" or manually making unsafe content via $sce. In this case, developers must be aware that they are 100% relying on the backend to provide good data.

Are you sure that the security team refers to XSS and not CSRF? Because CSRF has a totally different fix (see CSRF token exchange on google). If this is not the case, my gut says that they want encoded strings coming from client side (because they are too lazy to encode them themselves).

answered Oct 6, 2015 at 20:48

Dragos Rusu

1,57814 silver badges14 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

gerl · Accepted Answer · 2015-10-07 20:20:36Z

0

It turns out the server side did not sanitize inputted data. Even though I have validation set up, the security team uses an application that can call the POST ajax call without going through the web application..

answered Oct 7, 2015 at 20:20

gerl

1,1912 gold badges17 silver badges54 bronze badges

1 Comment

Dragos Rusu Over a year ago

It's always the BE guys fault, no matter what. We should make print some wallpapers with this quote :)

Collectives™ on Stack Overflow

angularjs prevent XSS attacks

2 Answers 2

Comments

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related