SecurityInnovation/TMContentReview — Issue #2: Encode All Output Data
Author: SergeTruth
Created: 2011-11-07 22:08:14+00:00
State: open

Applies to:
This advice is not limited to Servlets or JSPs. Can apply to all technologies that output untrusted data in a browser response.

Why
"Proper" encoding of input

When
When you say encode it first. I see developers tryintg to create a filter to blindly encode all request parameters on their way in. See comments in All Output Data In Encoded.doc for details.

Such data can be of "a" reflective or persistent nature.

In a persistent setting, the input is stored and returned to the client "when retrieved from the database".

Determine the type of encoding.

URL encoding:

The example here does not help the user understand what the URL context is and is language specific.

HTML encoding:

Is missing the ' (single quote) although some people believe "/" should also be included as it is used to end tags.

HTML Attribute Encoding:

It is not any attribute, but those that are not URL, CSS, and Javascript (through event handler attributes) attributes

The encoding used in

">...

Is different than encoding used here:

/>

CSS Encoding is not formatted correctly.

JavaScript Encoding
Need to describe the JavaScript context and how it differs from the DOM context.

You need to provide examples of all of the contexts. Also what are the encodings provided and how do they differ from the other contexts. In addition, which characters are encoded in each context and why? All of these need to be explained so a developer can understand that they not only have to encode but need to understand what characters are encoded and if that will mitigate against attacks within the context that output is being written to.

Apply the encoding

You need to talk about the different libraries and how they differ. ESAPI basically encodes all non-alpha numeric numbers while Apache Commons Codec will encode characters on a black list. Each encoding library has different quirks. Like some encoding libraries (Microsoft has one) do not encode ' (single quote). Other encoding libraries will JavaScript encode single quotes by prefixing with a blackslash (\') or forget to encode the backslash causing encoding to fail to block attacks.

Many of the comments from All Output Data Is Encoded.doc still applies to this document. Although the solution which was missing from All Output Data Is Encoded
is clearer.