Cross-Site Scripting: External Links

Sending unvalidated data to a web browser can result in the browser executing malicious code. Settings in the configuration can minimize and reduce the exposure to cross-site scripting

Cross-site scripting (XSS) vulnerabilities occur when:

1. Data enters a web application through an untrusted source, most frequently a web request or database.

2. The data is included in dynamic content that is sent to a web user without validation.

The malicious content sent to the web browser often takes the form of a JavaScript segment, but can also include HTML, Flash or any other type of code that the browser executes. The variety of attacks based on XSS is almost limitless, but they commonly include transmitting private data such as cookies or other session information to the attacker, redirecting the victim to web content controlled by the attacker, or performing other malicious operations on the user's machine under the guise of the vulnerable site.

Since attacks against XSS vulnerabilities often involve communicating with or redirecting to a malicious site controlled by the attacker, the ability to inject references to content on other domains is integral to many exploits. AntiSamy can be configured to prevent links to external domains, which diminishes the damage an attacker may cause through an XSS attack. However, this protection is only a partial solution and does not address the overall threat posed by XSS vulnerabilities.

Example 1: The following AntiSamy configuration entry allows links to URLs outside of the domain on which the application is running.

		<attribute name="href" onInvalid="filterTag">
			<regexp-list>
				<regexp name="onsiteURL"/>
				<regexp name="offsiteURL"/>
			</regexp-list>
		</attribute>