Towards a Post-XSS World - JSConf EU 2013

Cross-site scripting attacks are pervasive and dangerously exploitable threats to modern web applications, undermining the critical assumption that your app’s code is actually under your control. But you know that already; you’re likely playing whack-a-mole right now with one of the dozens of potential attack vectors your app exposes.

Happily, we’re this close to eradicating XSS with some new tools like Content Security Policy. Come spend a half-hour of your life learning how you can stop worrying about maliciously injected script. You’ll be glad you did!

Transcript

1. Towards a Post-
   XSS World
   Mike West
   https://mikewest.org
   G+: mkw.st/+
   Twitter: @mikewest
   Slides: https://mkw.st/r/jsconfeu13
   

   View Slide

2. http://www.html5rocks.com/en/tutorials/security/content-security-policy/
   https://mkw.st/r/csp
   

   View Slide

3. View Slide

4. Content injection
   is scary.
   

   View Slide

5. scheme://host:port
   

   View Slide

6. <br/>beAwesome();<br/>
   <br/>beEvil();<br/>
   

   View Slide

7. <br/>beAwesome();<br/>
   
   Hello, <br/>beEvil();<br/>!
   

   View Slide

8. <br/>p { color: {{USER_COLOR}}; }<br/>
   
   Hello {{USER_NAME}}, view your
   Account.
   
   <br/>var id = {{USER_ID}};<br/>
   
   

   View Slide

9. https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet
   goo.gl/XE0aW
   

   View Slide

10. [][(![]+[])[+[[+[]]]]+([][[]]+[])[+[[!+[]+!+[]+!+[]+!+[]+!+[]]]]+(![]+[])[+[[!+[]+!+[]]]]+(!![]+[])
    [+[[+[]]]]+(!![]+[])[+[[!+[]+!+[]+!+[]]]]+(!![]+[])[+[[+!+[]]]]][([][(![]+[])[+[[+[]]]]+([][[]]+[])
    [+[[!+[]+!+[]+!+[]+!+[]+!+[]]]]+(![]+[])[+[[!+[]+!+[]]]]+(!![]+[])[+[[+[]]]]+(!![]+[])[+[[!+[]+!+[]
    +!+[]]]]+(!![]+[])[+[[+!+[]]]]]+[])[+[[!+[]+!+[]+!+[]]]]+([][(![]+[])[+[[+[]]]]+([][[]]+[])[+[[!+[]
    +!+[]+!+[]+!+[]+!+[]]]]+(![]+[])[+[[!+[]+!+[]]]]+(!![]+[])[+[[+[]]]]+(!![]+[])[+[[!+[]+!+[]+!+[]]]]
    +(!![]+[])[+[[+!+[]]]]]+[])[+[[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]]]+([][[]]+[])[+[[+!+[]]]]+(![]+[])[+
    [[!+[]+!+[]+!+[]]]]+(!![]+[])[+[[+[]]]]+(!![]+[])[+[[+!+[]]]]+([][[]]+[])[+[[+[]]]]+([][(![]+[])[+
    [[+[]]]]+([][[]]+[])[+[[!+[]+!+[]+!+[]+!+[]+!+[]]]]+(![]+[])[+[[!+[]+!+[]]]]+(!![]+[])[+[[+[]]]]+
    (!![]+[])[+[[!+[]+!+[]+!+[]]]]+(!![]+[])[+[[+!+[]]]]]+[])[+[[!+[]+!+[]+!+[]]]]+(!![]+[])[+[[+[]]]]+
    ([][(![]+[])[+[[+[]]]]+([][[]]+[])[+[[!+[]+!+[]+!+[]+!+[]+!+[]]]]+(![]+[])[+[[!+[]+!+[]]]]+(!![]+
    [])[+[[+[]]]]+(!![]+[])[+[[!+[]+!+[]+!+[]]]]+(!![]+[])[+[[+!+[]]]]]+[])[+[[!+[]+!+[]+!+[]+!+[]+!+[]
    +!+[]]]]+(!![]+[])[+[[+!+[]]]]]((![]+[])[+[[+!+[]]]]+(![]+[])[+[[!+[]+!+[]]]]+(!![]+[])[+[[!+[]+!+
    []+!+[]]]]+(!![]+[])[+[[+!+[]]]]+(!![]+[])[+[[+[]]]]+([][(![]+[])[+[[+[]]]]+([][[]]+[])[+[[!+[]+!+
    []+!+[]+!+[]+!+[]]]]+(![]+[])[+[[!+[]+!+[]]]]+(!![]+[])[+[[+[]]]]+(!![]+[])[+[[!+[]+!+[]+!+[]]]]+
    (!![]+[])[+[[+!+[]]]]]+[])[+[[+!+[]]]+[[!+[]+!+[]+!+[]+!+[]+!+[]]]]+[+!+[]]+([][(![]+[])[+[[+[]]]]+
    ([][[]]+[])[+[[!+[]+!+[]+!+[]+!+[]+!+[]]]]+(![]+[])[+[[!+[]+!+[]]]]+(!![]+[])[+[[+[]]]]+(!![]+[])[+
    [[!+[]+!+[]+!+[]]]]+(!![]+[])[+[[+!+[]]]]]+[])[+[[+!+[]]]+[[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]]])()
    

    View Slide

11. [][(![]+[])[+[[+[]]]]+([][[]]+[])[+[[!+[]+!+[]+!+[]+!+[]+!+[]]]]+(![]+[])[+[[!+[]+!+[]]]]+(!![]+[])
    [+[[+[]]]]+(!![]+[])[+[[!+[]+!+[]+!+[]]]]+(!![]+[])[+[[+!+[]]]]][([][(![]+[])[+[[+[]]]]+([][[]]+[])
    [+[[!+[]+!+[]+!+[]+!+[]+!+[]]]]+(![]+[])[+[[!+[]+!+[]]]]+(!![]+[])[+[[+[]]]]+(!![]+[])[+[[!+[]+!+[]
    +!+[]]]]+(!![]+[])[+[[+!+[]]]]]+[])[+[[!+[]+!+[]+!+[]]]]+([][(![]+[])[+[[+[]]]]+([][[]]+[])[+[[!+[]
    +!+[]+!+[]+!+[]+!+[]]]]+(![]+[])[+[[!+[]+!+[]]]]+(!![]+[])[+[[+[]]]]+(!![]+[])[+[[!+[]+!+[]+!+[]]]]
    +(!![]+[])[+[[+!+[]]]]]+[])[+[[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]]]+([][[]]+[])[+[[+!+[]]]]+(![]+[])[+
    [[!+[]+!+[]+!+[]]]]+(!![]+[])[+[[+[]]]]+(!![]+[])[+[[+!+[]]]]+([][[]]+[])[+[[+[]]]]+([][(![]+[])[+
    [[+[]]]]+([][[]]+[])[+[[!+[]+!+[]+!+[]+!+[]+!+[]]]]+(![]+[])[+[[!+[]+!+[]]]]+(!![]+[])[+[[+[]]]]+
    (!![]+[])[+[[!+[]+!+[]+!+[]]]]+(!![]+[])[+[[+!+[]]]]]+[])[+[[!+[]+!+[]+!+[]]]]+(!![]+[])[+[[+[]]]]+
    ([][(![]+[])[+[[+[]]]]+([][[]]+[])[+[[!+[]+!+[]+!+[]+!+[]+!+[]]]]+(![]+[])[+[[!+[]+!+[]]]]+(!![]+
    [])[+[[+[]]]]+(!![]+[])[+[[!+[]+!+[]+!+[]]]]+(!![]+[])[+[[+!+[]]]]]+[])[+[[!+[]+!+[]+!+[]+!+[]+!+[]
    +!+[]]]]+(!![]+[])[+[[+!+[]]]]]((![]+[])[+[[+!+[]]]]+(![]+[])[+[[!+[]+!+[]]]]+(!![]+[])[+[[!+[]+!+
    []+!+[]]]]+(!![]+[])[+[[+!+[]]]]+(!![]+[])[+[[+[]]]]+([][(![]+[])[+[[+[]]]]+([][[]]+[])[+[[!+[]+!+
    []+!+[]+!+[]+!+[]]]]+(![]+[])[+[[!+[]+!+[]]]]+(!![]+[])[+[[+[]]]]+(!![]+[])[+[[!+[]+!+[]+!+[]]]]+
    (!![]+[])[+[[+!+[]]]]]+[])[+[[+!+[]]]+[[!+[]+!+[]+!+[]+!+[]+!+[]]]]+[+!+[]]+([][(![]+[])[+[[+[]]]]+
    ([][[]]+[])[+[[!+[]+!+[]+!+[]+!+[]+!+[]]]]+(![]+[])[+[[!+[]+!+[]]]]+(!![]+[])[+[[+[]]]]+(!![]+[])[+
    [[!+[]+!+[]+!+[]]]]+(!![]+[])[+[[+!+[]]]]]+[])[+[[+!+[]]]+[[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]]])()
    alert(1);
    

    View Slide

12. "I discount the
    probability of
    perfection."
    -Alex Russell
    

    View Slide

13. "We are all idiots
    with deadlines."
    -Mike West
    

    View Slide

14. http://traumwerk.stanford.edu/philolog/2009/10/homers_odyssey_in_art_sirens_f.html
    

    View Slide

15. http://w3.org/TR/CSP11
    

    View Slide

16. View Slide

17. Content-Security-Policy:
    default-src 'none';
    style-src https://mikewestdotorg.hasacdn.net;
    frame-src https://www.youtube.com
    https://www.speakerdeck.com;
    script-src https://mikewestdotorg.hasacdn.net
    https://ssl.google-analytics.com;
    img-src 'self'
    https://mikewestdotorg.hasacdn.net
    https://ssl.google-analytics.com;
    font-src https://mikewestdotorg.hasacdn.net
    

    View Slide

18. Content-Security-Policy:
    default-src ...;
    script-src ...;
    object-src ...;
    style-src ...;
    img-src ...;
    media-src ...;
    frame-src ...;
    font-src ...;
    connect-src ...;
    sandbox ...;
    report-uri https://example.com/reporter.cgi
    

    View Slide

19. Content-Security-Policy-Report-Only:
    default-src https:;
    report-uri https://example.com/csp-violations
    {
    "csp-report": {
    "document-uri": "http://example.org/page.html",
    "referrer": "http://evil.example.com/haxor.html",
    "blocked-uri": "http://evil.example.com/img.png",
    "violated-directive": "default-src 'self'",
    "original-policy": "...",
    "source-file": "http://example.com/script.js",
    "line-number": 10,
    "column-number": 11,
    }
    }
    

    View Slide

20. https://twitter.com/rwaldron/status/371801007829041153
    

    View Slide

21. <br/>function handleClick() { ... }<br/>
    Click me!
    Click me!
    

    View Slide

22. 
    
    Click me!
    Click me!
    
    function handleClick() {
    ...
    }
    function init() {
    for (var e in document.querySelectorAll('.clckr'))
    e.addEventListener('click', handleClick);
    }
    

    View Slide

23. Content-Security-Policy:
    script-src 'nonce-afbvjn+afpo-j1qer';
    Click me!
    Click me!
    <br/>function handleClick() { ... }<br/>function init() {<br/>var e;<br/>for (e in document.querySelectorAll('.clckr'))<br/>e.addEventListener('click', handleClick);<br/>}<br/>
    

    View Slide

24. `eval()` is evil?
    

    View Slide

25. http://www.html5rocks.com/en/tutorials/security/sandboxed-iframes/
    goo.gl/WJjv10
    

    View Slide

26. http://www.html5rocks.com/en/tutorials/security/content-security-policy/
    https://mkw.st/r/csp
    

    View Slide

27. http://lcamtuf.coredump.cx/postxss/
    

    View Slide

28. https://mkw.st/r/jsconfeu13
    https://mkw.st/r/csp
    Danke!
    Mike West
    https://mikewest.org
    G+: mkw.st/+
    Twitter: @mikewest
    

    View Slide