Upgrade to Pro — share decks privately, control downloads, hide ads and more …

How CSP Will (maybe) Solve the XSS Problem

E0fdc1036537c1308400fc8ba6e987b0?s=47 Neil Matatall
September 12, 2014
Programming
0
120

How CSP Will (maybe) Solve the XSS Problem

More ramblings about how awesome csp and how it solves all of your problems.

E0fdc1036537c1308400fc8ba6e987b0?s=128

Neil Matatall

September 12, 2014
Tweet

More Decks by Neil Matatall

See All by Neil Matatall
E0fdc1036537c1308400fc8ba6e987b0?s=48 oreoshake
0
98
E0fdc1036537c1308400fc8ba6e987b0?s=48 oreoshake
0
88
E0fdc1036537c1308400fc8ba6e987b0?s=48 oreoshake
0
83
E0fdc1036537c1308400fc8ba6e987b0?s=48 oreoshake
0
160
E0fdc1036537c1308400fc8ba6e987b0?s=48 oreoshake
0
110
E0fdc1036537c1308400fc8ba6e987b0?s=48 oreoshake
2
160
E0fdc1036537c1308400fc8ba6e987b0?s=48 oreoshake
3
970

Other Decks in Programming

See All in Programming
Add1036688abcb2e3dbff7c3090f7e35?s=48 imtnd
0
920
Af64bc38c0ffcfcabdf430759ee491ce?s=48 lovee
4
220
Db8a7eb9cf22f26cedce8295a53c8d7c?s=48 kawazu
0
360
7166bc2cbc462ab5fd1987a76d0fe709?s=48 takahirom
1
730
F9d1e7c494103e9ad73723d4496334f9?s=48 mattdclarke
0
190
4651f57d479e562a45dd624cc24dbee3?s=48 nsaito9628
0
930
96466365a9bf7e66990f2b9ba547b02f?s=48 yumu19
1
720
E0e036f89c14b3e59640318eedf9670b?s=48 bkuhlmann
4
420
922f51d458d6ffee8578b9d3ab0a52b6?s=48 ug
1
180
406a99778248522c9acfe1f95b217a55?s=48 kotakawase
0
520
F9d1e7c494103e9ad73723d4496334f9?s=48 mattdclarke
0
170
F9e11bea0c22333596791dd0696f5d4f?s=48 daiksy
1
3.1k

Featured

See All Featured
766b9746b59e6f09e280cd33cf4ed419?s=48 skipperchong
14
1.2k
864a009ac73600c7c02e1f26629dd989?s=48 paigeccino
7
600
E14f55d3f939977cecbf51b64ff6f861?s=48 keithpitt
405
20k
8ec1383b240b5ba15ffb9743fceb3c0e?s=48 philnash
23
1.3k
1519587b1a0febb658c36c94f6272b0d?s=48 roundedbygravity
249
22k
78b475797a14c84799063c7cd073962f?s=48 holman
464
280k
95d9f37115fbb0d13135d0f77132f856?s=48 morganepeng
100
15k
E76911cbe088e5b850d966de3fc7435b?s=48 robhawkes
56
4.1k
32de0bd2ba869609d26fd052a4622778?s=48 cromwellryan
109
6.7k
4394ceb8b277f35ee3da7030384efb5d?s=48 davidbonilla
75
3.8k
651dcfe41723207fbb0aa044a4f7c07f?s=48 dotmariusz
100
5.8k
E9221b172e78e888355fa2fe4541b595?s=48 mclloyd
7
7.9k

Transcript

  1. How CSP Will (maybe) Solve the XSS Problem Neil Matatall

    OWASP SD 4/17/2014

  2. Me • Twitter appsec engineer • I’m actually just a

    developer • In the business of going out of business • Sick and tired of fixing XSS

  3. XSS is so 1998

  4. So is XSS prevention

  5. What is XSS <input name=“id” value=“<%=id%>”>

  6. What is XSS ”><script>badStuff()</script>

  7. What is XSS <input name=“id” value=“”> <script>badStuff()</script> ”>

  8. What is XSS <script> var id=<%=id%>; </script>

  9. What is XSS 0;badStuff();

  10. What is XSS <script> var id=0; badStuff() </script>

  11. What is XSS <script> setInterval(1000, ‘<%=todo%>’) </script>

  12. What is XSS badStuff();

  13. What is XSS <script> setInterval(1000, ‘badStuff()’) </script>

  14. What is XSS <input name=“id” onBlur=“doStuff(<%=id %>)”>

  15. What is XSS ); badStuff(

  16. What is XSS <input name=“id” onBlur=“doStuff(); badStuff()”>

  17. What is XSS <a href=“<%=link%>”>Hi Mom!</a>

  18. What is XSS javascript:badThings()

  19. What is XSS <a href=“javascript:badThings()”> Hi Mom!</a>

  20. What is XSS <a href=“#” onClick=“doThing(‘<%=link%>’)”> Hi Mom! </a>

  21. What is XSS &#39;);badStuff(&#39;

  22. What is XSS <a href=“#” onClick= “doThing(‘&#39;);badStuff(&#39;’)” > Hi Mom!

    </a>

  23. What is XSS <a href=“#” onClick= “doThing(‘’);badStuff(‘’)”> Hi Mom! </a>

  24. What is DOM XSS <script> document.body.innerHTML = document.getElementById(‘name’).value; </script>

  25. What is DOM XSS

  26. What is DOM XSS <body> <img src=x onError=badThings()> </body>

  27. What is DOM XSS <script> var name = $(‘#name’).val $(‘body’).html(name)

    </script>

  28. What is DOM XSS

  29. What is DOM XSS <body> <img src=x onError=badThings()> </body>

  30. jQuery is XSS $(data)

  31. What is XSS <style> a { color: <%=usersFavoriteColor%>; } </style>

  32. What is XSS I dunno, something with SVG, CSS Expressions,

    etc. The list grows.

  33. Because Dr. Mario

  34. Because Dr. Mario

  35. Why do those crazy things?

  36. CODE != DATA “select * from table where id =

    “ + id “<a href=“ + link + “>text</a>”

  37. But we don’t do stupid things

  38. I will religiously escape content

  39. I will religiously escape content part 2

  40. JSFuck - Write any JavaScript with 6 Characters: []()!+ I

    will religiously escape content part 3
  41. None

  42. I’ll sanitize / validate input

  43. I’ll use a scanner

  44. I’ll perform periodic assessments

  45. Security is about layers

  46. None

  47. Thermos? Koozie?

  48. <script>goodStuff()</script> <script>badStuff()</script> How does the browser know?

  49. What is dangerous? • inline javascript • <script>…</script> • <input

    onBlur=“…”> • <a href=“javascript:…”> • on-the-fly code generation • setTimeout, eval, new Function(“…”)

  50. What’s a CSP??? default-src ‘self’; connect-src ‘self’; font-src ‘self’ data:;

    frame-src ‘self’ about: javascript:; frame-ancestors https://twitter.com; img-src https://mycdn.xom data:; media-src ‘https://mycdn.xom; object-src ‘none’; script-src https://mycdn.xom; style-src 'unsafe-inline' https://mycdn.xom; report-uri https://twitter.com/scribes/csp_report

  51. CSP is more than XSS protection

  52. Nothing is free

  53. Report-Only mode

  54. Techniques for removing inline javascript

  55. Removing the dangerous stuff

  56. CSP 1.1 • Whitelisting inline <script> in a safe way

  57. Inline code <script> stuff() </script>

  58. Nonces <script nonce=“34298734…”> stuff() </script>

  59. Hashes <script> stuff() </script>

  60. Hashes are more secure, and more limited than nonces

  61. What you still can’t do • Inline event handlers •

    <input onBlur=“doGoodThing()”> • <a href=“javascript:…”> • Dynamic javascript • <script> var id=<%=id%> </script> • Hash values won’t match • Nonce provides absolutely no security

  62. Automatic CSP Protection (Silverish bullet)

  63. Whitelisting javascript • Find all javascript • Compute all hash

    values • Whitelist scripts with corresponding hashes

  64. Assume: Sane web framework • Do a regular expression search

    over all templates, capture all inline javascript • Store a map of the hash(es) in each individual file • Each time the file is rendered, add the corresponding hashes to the header

  65. Developer productivity • Serve dynamic hash values in (!production), serve

    hardcoded hash values in production
  66. None