MLstate/opalang — Issue #33: Reflected Cross Site Scripting in error messages on IE 6/7/8, maybe Safari
Author: nabla-c0d3
Created: 2012-02-01 07:51:46+00:00
State: open

When triggering an error message, for example:
* By sending a bad value within a ping command
* By trying to navigate to an invalid rpc_return value

The server sends back a blank page with an error message that sometimes reflects values sent in the request.
The server's response has a content-type header set to "text/plain" which should, in theory, prevent browsers from rendering the body of the response as HTML. However, IE 6/7/8 and Safari still parse the response, and render it if they identify it as HTML.

As such, if one of the value that gets reflected in the error message has HTML tags or JavaScript in it, it will be executed.
I was able to get it working on IE8, haven't tried with Safari.

Reproduction Steps on IE8:
* Send a ping command (like "POST /_internal_/342680940/ping" ) with "" as the request body (instead of the number).
* OR browse to an invalid RPC return, for example "http://www.the-server.com/_internal_/342680940/rpc_return/228308626?t="

IE 8's XSS filter may or may not prevent it.

Anyway, any parameter that was sent by the user and that gets reflected in the response should be output encoded.

I haven't written a single line of Opa, and found this issue by looking at examples of Opa-based website.
Hopefully my explanations still make sense!