Första XSS-attacken mot vår blogg

Det här är inte speciellt dramatiskt egentligen, men lite kul med action. Någon postade för en stund sen en XSS-länk på den engelska delen av vår hemsida.

Jag visste att kommentarsfältet inte var skyddat mot HTML och har inte brytt mig om att fixa det förrän nu.

Attackvektorer

I kommentaren som postades låg följande html-tagg och det är alltså bara en test för att se ifall det gick att köra javascript genom kommentarerna på vår blogg.

<INPUT TYPE="IMAGE" src="javascript:alert('XSS');">

På ha.ckers.org's XSS (Cross Site Scripting) Cheat Sheet kan man läsa att denna vektor inte fungerar på IE7 eller FF2 men på IE6 och Opera. Där finns även fler referenser till andra vektorer.

Hur man skyddar man sig mot XSS (med .NET)

Det enklaste alternativet är att låta validateRequest vara på slaget som det är som standard. Nackdelarna är att det då inte går att posta taggar över huvudtaget och att ett error visas. Läs mer om för-/nackdelar ValidateRequest här. I vår blogg som handlar om webbutveckling vill vi ju kunna tillåta html-kod från våra besökare, så vi har detta skydd avstängt.

Istället ser vi till att använda Server.HtmlEncode på all text som kommer från besökaren (det var detta jag just la till).

En bra effekt är att det numera går att skriva htmlkod i kommentarerna och den visas som den ska. Vissa har ju märkt att det inte fungerat så bra tidigare och vi borde ha fixat det för länge sen.

Testning tillåtet

Om nån är intressarad får ni gärna försöka att posta XSS till detta inlägget. Jag antar att det är omöjligt men vem vet om det finns någon obskyr metod som inte HTMLEncode klarar av att filtera.

Har även lagt in en liten funktion som ska göra om url till länkar. Där kan jag tänka mig att det kan gå att få in någon XSS-variant. Så här ser funktionen ut ifall nån vill prova att "hacka" den.

public string ConvertUrlToHyperlink(string strInput)
{
string strPattern = @"(?<url>http://(?:[\w-]+\.)+[\w-]+(?:/[\w-./?%&~=]*[^.\s|,|\)|<|!])?)";
string strReplace = "<a href=\"${url}\" target=_blank>${url}</a>";
string strResult;
strResult = Regex.Replace(strInput, strPattern, strReplace);
strPattern = @"(?<!http://)(?<url>www\.(?:[\w-]+\.)+[\w-]+(?:/[\w-./?%&~=]*[^.\s|,|\)|<|!])?)";
strReplace = "<a href=\"http://${url}\" target=_blank>${url}</a>";
strResult = Regex.Replace(strResult, strPattern, strReplace);

return strResult;
}

Comments

testar länkar http://codeodyssey.se/blog.aspx?id=352#write-comment

Thanks for making such a cool project. I've been checking the site for the Windows version, but I never left a comment about it. I know you are working hard and doing it for free so you shouldn't feel rushed or anything

Thanks for making such a cool project. I've been checking the site for the Windows version, but I never left a comment kw:essay writing service about it. I know you are working hard and doing it for free so you shouldn't feel rushed or anything

I appreciate your idea here.my profile Definitely it has a good content. Thank you for imparting more of your own thoughts. look at my profile Good job! my site

Excellent post share with us and this blog is impresses more people to reading that blog

Most enticing blogs I’ve ever read and this is what it should. Must be shared as well. I was really bored awriter.org but your blog lightened up my day

Good

Your post is really very good and i appreciate. It's hard to sort the good from the bad sometimes but i think you have nailed it. You write very well which is amazing . I really impressed by your post. Thanks for sharing.

Thanks for sharing great information.Excellent post share with us and this blog is impresses more people to reading that blog.thanks

Thanks for sharing great information.Excellent post share with us and this blog is impresses more people to reading that blog.thanks http://www.onlinepromotionuae.ae

Thanks for sharing great information.Excellent post share with us and this blog is impresses more people to reading that blog.thanks http://www.onlinepromotionuae.ae

I like your all post. You have done really good work. a10, color switch

I appreciate your working style at the end just my request is please share with us some more great post... roblox, mortal kombat x

Nice post! Thanks for sharing with us.

eCommerce Web Development Company

Our products are authentic http://www.essay-writing.co.uk/ and free of plagiarism. Each essay is examined for plagiarism.

good posting.. Web Promotion Company in Delhi

Is it so really important? Get it easy, watching http://camsdesire.com/anal-play. Hot girls, hot asses, amazing views ;)

I am so delighted to be here and wanna say thanks for share this with us. I am so delighted to reach here and to take a overview on your page. Call Girls in Chandigarh

I just want to say thanks for your wonderful post, it is contain a lot of knowledge and information that i needed right now. You really help me out my friend, thanks ! gmail sign login

Great work and this one has shown a lot of new potential blog writers on the fold. nursing schools California

I think we are going to get more such posts in coming weeks on the blog. prayers

I have read your post.I wanna inform you that Cyber Monday sale is out now.You can get latest discount coupons here.Thank you. Hostgator cyber Monday 2016

I was on your website and reading your blog. You have shared very informative blog for every one. Please keep update from your more blogs. Thanks for sharing this with me. [url="http://packagingboxessupplier.com/packaging-boxes/bottle-packaging-boxes.html"]Discounted USA Bottle Packaging Boxes[/url]

Moreover, the changing of IP addresses like 192.168.1.1 can also have an impact on the backing up files process to network storage devices.

Great blog. Get instant solution for System has crashed with important files inside issue from Toshiba technical support team. Now you can call us @0800-098-8371 Toshiba Customer Care Number UK.

Thanks for this awesome web page, i like it Dell Printer Support

thanks for this page

Hello there, Very pleasant your blog entry. I read this blog. I get critical data with your blog. so I like it. thank for sharing post.

Great information I will tweet to my friends to get them to check it out. keep it up. Gurgaon Call Girls Service

http://mozillafirefox2017freedownload.com http://avgfreedownload2017.com/"> http://avgfreedownload2017.com/

I think my browser is old or not supported for the post, i cant seen any portfolio or image, but i can read the text and i enjoyed the post you shared Casio g Shock Watches in UK

Hong Kong Tailor Recommendation

It is very useful for my future. keep sharing. This is really a great stuff for sharing. Keep it up .

website

this post give me lots of advise it is very useful for me. this article is really one of the very best in the history of article.

over here

I was amazed by you. the way you create a website very thorough and good. This is very very impressive. Thank you for sharing hopefully more successful Godaddy one dollar hosting

Welcome, Very great your blog zone. I am especially lively and incredible this. When I read this blog portion. So I like it. Appreciative to you for giving this post to us. http://www.postescortcontent.in/ http://www.escortguestblogs.in/ http://www.contentpost.in/ http://www.addpostcontent.in/ http://www.postarticle.in/

download youtvplayer apk now for free

hntyemjkuku

Thanks for sharing. I hope it will be helpful for us. Jaipur escorts

Marvelous post which I need to explore more thanks a lot sir for this kind article. http://www.delhiescortsgirl.com"> http://www.delhiescortsgirl.com

Thanks for sharing the post. This is a wonderful and amazing article. [url=http://www.chandigarhescortsgirl.com] escorts in chandigarh [/url]

I like your post ,its so amazing and helpfull top 10 horror movies of all time

It so important and helpfull for us. 99logo design 

Awesome and interesting article. Great things you’ve always shared with us. Thanks Call Girls in Mahipalpur

Howdy, Very better than frequent, your prepared to look at this is believed. I am incredibly interesting the details. I like it. I am ahead to another material with you. grateful to you.

I really liked the way you have done it here thanks a lot for making this happen - escorts in Jaipur

To get to the jcp associate kiosk website, you only need to enter that website’s address into your browser, and your browser will then transfer you to the said site (as long as your computer is connected to the Internet). jcp kiosk If you check towards the end of this article, in the section entitled ‘links to get you going’, jcpenney associate kiosk you will find the address we are making reference to: that is, the address you can enter into your browser, in order to be taken to the jcpenney associate kiosk website.

Hi, I really like the new site!! I know how a lot of your, considered, and serious take it out needs for example another web a way to satisfaction. You've done it.

I enjoyed on reading your blog post. Your blog has a lot of useful information for me, I got good ideas from this great blog. I'm always looking for this type of blog post. I hope I will be reading more of your posts further. Jaipur Escort Service

I was reading the provided article with a great interest! This post is useful and informative. Chandigarh Call Girl

This article is enough informative and I have better understanding with the topic now

The key concept in this blog is very impressive and now I have better understanding with this topic

Really structured and useful information. And everything you can see, thanks. I seemed through something and must say, they are fantastic. [http://www.independentescortdelhi.com/][1] [http://www.royaldelhiescorts.in/][2] [http://www.delhihotbabes.com/][3]

Hi, I really like the new site!! I know how a lot of your, considered, and serious take it out needs for example another web a way to satisfaction. You've done it.

Hi, I really like the new site!! I know how a lot of your, considered, and serious take it out needs for example another web a way to satisfaction. You've done it.

valentines day

Thumbs up guys your doing a really good job. Escorts in Jaipur

Thanx for giving me a wander full appealing. really this is the good site. visit this website. active target mobile coupon codes

The most famous escort office in all Delhi Searching the delightful Delhi female escort that advantageous for your extraordinary request and fundamental.

App Coiner is a site that claims to pay people for testing apps and reviewing them. This product is suitable for everyone who owns a smartphone or tablet and don’t mind making extra cash app coiner coupon

I feel it interesting, your post gave me a new perspective, Thanks for sharing. Visit my site One Euro Hosting Here you will able to save your extra money by using Godaddy domain name coupons on deals and offers.

A night spent with our Bangalore Female Escorts Service will be such a night that you wish come again and again in your life.

The Alzheimer's Association gives free, easy-to-use tools and staff support to enable members to achieve their fundraising. Jaipur Escorts

this is nice articale

contact phone number, contact number,

Thanks for sharing a very interesting article about 10 Advice: Publishing Chassidus Essay. This is very useful information for online blog review readers. Keep it up such a nice posting like this. http://www.dubaisugarbabes.com"> http://www.dubaisugarbabes.com

I was taking a look at some of your content on this site and I conceive this web site is actually instructive! Keep adding. Gurgaon Call Girls

Excellent and nice article. when user want to get important information then visit our site. Bangalore Call Girls

nice article . thaks . visit my site for new information

Hello Gentleman Aisha an Escorts in Pune to meet new people and want to explore more about them

I am glad to see this brilliant post. all the details are very helpful and useful for us http://www.hotkiran.com/

I AM USUALLY TO BLOGGING AND THAT I REALLY APPRECIATE YOUR ARTICLES. THIS GREAT ARTICLE HAS Active Target Promo Codes TRULY PEAKS MY INTEREST. I AM ABOUT TO BOOKMARK YOUR WEB BLOG AND KEEP CHECKING CHOOSING DETAILS.

I must say I impressed with your work. I loved to read such kind of article which is one of these, I've found here a lot of interesting information. this site ideal for my knowledge I need.

Hi,Thanks for sharing, this is a fantastic article post.Thanks Again. Keep writing. I like it.

Hi,Thanks for sharing, this is an awesome article post.Thanks Again. Continue composing. I like it. http://www.tararaajput.in/

Wow,I simply want to tell you that I am new to weblog and definitely liked this blog site. Thanks Again. Keep making. I like it. http://www.rimjhimkhanna.in/ http://www.travelescorted.in/

I really like this post it was excellent and integrating post. I must say I enjoy reading this article thanks a lot for sharing this article and continue to good work. New Year 2019 Images

Thank you for your great post, I was looking for this information a long time, here you share the messages, I am pleased to visit the perfect article. Awesome! http://www.aayah.in/

it's brilliant website and I like to see more post. Really good information you are sharing with us. I’m also an expert in this topic so I can understand your hard work. http://www.saynagoaescorts.com/

Also great blog here with all of the valuable information you have. Keep up the good work you are doing here. http://www.jaimee.in/

Whether you are feeling lonely or merely searching for a solution to fulfil your sexual desire, jiya is always there to look after your physical and psychological necessities. She ensures you 100% decent and dependable providers in Jaipur. http://www.jiyajaipurescort.com/

Thank you so much for sharing valuable information! I was searching something just like this for my project! I am so thankful that I came across to your site. http://www.mayamadam.in/

This is definitely a good article. You make this information interesting and engaging with your readers. I really appreciate your kindness in sharing such amazing article like this. http://nainitalfemaleescorts.in/

A lot of useful information here. I'm sending it to several palsies and additionally sharing in delicious. And obviously, thanks on your effort! http://www.priya-sharma.com/

Hi, I Already Following this link. Very nice information provided by here. My suggestion is Everyone is trying to follow this link you will more information. http://www.ridhimagupta.com/

I'd really want to meet you in the feeding table from magnanimousness hotels of town. However cherishing it would be the point at that we have a tendency to every cover a brief while along ahead of the night's refulgent actual familiarity. I'm a completed bundle for several of the sex-related objectives. http://www.sheerat.in/

I'm rather magnificent and pleasant and what's more I actually have a foundation that is distinguished. I'm not sensible for everybody. Just elegant folks will bear the worth of your own company. I maintain an attractive style. I want to meet shoppers in expansive hotel. http://www.shilki.in/

If it turns to the situation of maturity, guys constantly yearns to get girls in their own life to be adored and made love . She's professional, proficient and better compared to the typical escorts. Independent escorts such as tanika undergo different training sessions to flip out as the top ones in town. http://www.tanika.in/

The dreams city of everyone is the Goa which is also known as The Film City in India. The city is famous for its tall buildings and deep seas. Some people come here to fulfill their dreams and some come here to enjoy the beauty of this fascinating town. If you are in Goa, then we are proudly saying you that you are in the luckiest city of India. It's a beautiful hub of Goa Call Girls, where you can get the satisfaction easily. It's because you can afford all types of call girls here. It's a There are so many categories and services for you. Our hot call girls in Goa are so energetic, so you need some preparation to handle these wild babes. The level of hotness is so high. After spending a night with our models makes your mind and body refreshed. The never taste the love of our models before, it's something new and modern. Russian Escorts in Goa

Goa Escorts Service by High Profile gorgeous, passionate Russian and Indian World Class VIP Goa Escort girl with incall or outcall at 3 to 7 star hotels. Visit Your My Beautiful Site :-
[High Class Goa Escorts][1]

If you desire to get together Escorts Andheri with a temperamental character, then there is no other place beyond the internet, but you will be amazed to recognize that in this world of internet, you can also fool some trivial and grasping girls. That can be a problem for you and become as a substance of disappointment.

If you are in Jaipur and need beautiful Jaipur Escorts or white skin Jaipur Escorts then you can simply book call girls in Jaipur from one of the best escort agency named Jaipur Escorts. It is No.1 premier escort agency and provides both incall or outcall facility to clients. Please click on the following link to check the official websites Jaipur Escorts

very interesting information, I really like it because it can add insight for me more $1 Hosting Godaddy, thank you very much for this extraordinary information

Thanks for this web site post and discussing your own results with us. Very well executed! I think a lot of people battle to understand paying attention to a lot of controversial things in connection with this topic, but your own results talk for themselves. Coursework writing services

https://www.escortsvilla.co.in/

https://www.escortsvilla.co.in/

Nice Post A With Great information, Call Girls in Andheri like it.

Welcome, I am will remain your site and keep checking for thing new information. Thankful for encasing these records. appreciative. http://www.gurgaonrussianescorts.com/ http://www.gurgaonescortsgirl.in/ http://www.rimjhimkhanna.in/ http://www.riyapatel.in/ http://www.minna.in/

||gurgaon call girls||

||Puri call girls||

||Bhubaneswer call girls||

||Cuttack call girls||

||gurgaon call girl||

||Puri call girl||

||Bhubaneswer call girl||

||Cuttack call girl||

Hello guys ! How are you? Are you alone? Don't worry. I'm with you. If you want to sleep with me on bed with all physical love and entertainment, You shuold follow me on the links specified bellow.

[https://www.kolkataescortsgirl.com/][1]

Thanks and have a good luck!

As you folks realize our Society Call Girls look exceptionally messy on the grounds that Call Girls implies what offers sex to individuals. be that as it may, there are a few people in a similar society for whom call Girls are a methods for satisfying their Lust. do you additionally appreciate this amusement a ton. so come Goa where you will get the best and engaging call young ladies administrations. our Goa escorts organization is famous for best class prostitute benefit in the entire Goa where you get 24*7. Visit My Beautifull site :- http://janvivohra.com/ http://riyagoaescorts.co.in http://julia-sen.com http://lucy-jade.com Email Id :- itsmejanvivohra@gmail.com"> itsmejanvivohra@gmail.com

Hello there Everyone,Our New Hi profile Call Girls in Mumbai benefit aren't exclusively kept to people with position anyway individuals who have a place with social class likewise can get to the administrations given by our driving New Mumbai call young lady who are to a great degree adroit and capable. You ought to just pick the call young lady who accommodates your desires and gives us your decision through phone call or email.☏ Visiting Link Hare ☟ Visit My Beautifull site :- https://simranmumbaiescorts.com/

Contact :- +91-9538374281

Escorts Service Kolkata offers you one-stop answer for benefitting as much as possible from your work excursions. On occasion, the customers should be engage to get some business orders. Kolkata escort offices can be your ideal call girls in making this conceivable as different girls from particular highlights are accessible to offer their own administrations. Visit My Beautifull site :- http://ritudas.com/ Contact :- +91-9100000000

Hi, I am Sonalaggarwal I am a professional sales girl. I am providing Escorts service in Mumbai for extra earning. As I provide a good service to my customers and make them happy. I love to have intercourse with the customer. So call me to be happy. Visit :- http://sonalaggarwal.in/

Your articles are to an extraordinary degree stunning and I got a gigantic proportion of information and heading understanding them Awesome Blog! you'd a phenomenal action in your article. The substance is excessively magnificent.

http://queensmumbai.com/

My Self is Rinki Arora and I welcome you to my website with open arms. I recognized as well as own this web page through which I offer Surat private escorts services to all the amazing people like you. I know just how much you would appreciate being in the Agency of an amazing escorts, and this is what I offer to you with the assurance to take you to the levels of enjoyment you would not even think about. With the objective to give services in every aspect of the Indian, I offer only the best of what you can ask for! When you are with me, you will certainly be left amazed with my attraction and character. Individuals tell me, whenever I grin, their middle miss for a defeat. I want you too to tell me so, and believe in me you are going to overlook more than just one heartbeat! I come from a top excellent classification family, so my way of life period is also quite stylish and stylish. My sight will take strong into your middle and entice you until you can take no more. You usually stay certain that you will get to have the best interval of your everyday way of life period until you will follow me.

Air-Hostess Dwarka Escorts Dwarka Call Girls Service Call Girls Dwarka Call Girls in Dwarka Celebrity Escorts in Dwarka Housewife Escorts in Dwarka Dwarka Independent Escorts College Call Girls in Dwarka Russian Escorts in Dwarka

GO WITH >> http://muskangirlsdwarka.in/"> http://muskangirlsdwarka.in/

muskangirlsdwarka@gmail.com

Don’t miss this opportunity to enjoy the professional companion services in the garden city of India. You can see a great selection of beautiful escort girls who could give you the ultimate satisfaction with their Female Escorts Bangalore. All are handpicked independent profiles who could serve the dazzling experience to my elite class clients. All the website visitors are saying, they have never seen such hot and sexy escorts girls in their life. I have tried my level height to deliver the real information about every profile within my team. Pick your secret girlfriend to enjoy a very romantic event. Visit Here: https://bit.ly/2tqzsiq"> https://bit.ly/2tqzsiq

I appreciate that you are providing such valuable information. a big thumbs up from my side. this type of stuff hardly found on the internet.

http://khushiverma.com/

http://www.aimee.in

Jaipur escorts

http://www.swetu.in/

Meet with beautiful girl who offer elite services within cheap rates.

I simply discovered this online journal and have high trusts in it to proceed. Keep up the considerable work, its elusive great ones. I have added to my top picks. Much obliged to You.

Web Ocean Design Provide multiple services. We build great Software’s. We do Customized Software Development, Web Designing, Mobile Applications, Social Media Marketing, Internet/Intranet Applications, Search Engine Optimization (SEO), e-Commerce Applications, Graphic Designing. http://www.weboceandesign.com"> http://www.weboceandesign.com

I am glad to locate your recognized method for composing the post. Presently you make it simple for me to comprehend and execute the idea. Much obliged to you for the post.

6325019202014

6325019202014

6325019202014

JES Offer Escorts Service in Jaipur With independent Call Girls. Book With us Hot Escorts in Jaipur or Model Escorts, Housewifes, Collage Girls And Many More Tips Sexy Escort.

Jaipur Escorts - JES

link text

Please fill out all the fields.

*
*