Upgrade to Pro — share decks privately, control downloads, hide ads and more …

How CSP Will (maybe) Solve the XSS Problem

E0fdc1036537c1308400fc8ba6e987b0?s=47 Neil Matatall
September 12, 2014
Programming
0
120

How CSP Will (maybe) Solve the XSS Problem

More ramblings about how awesome csp and how it solves all of your problems.

E0fdc1036537c1308400fc8ba6e987b0?s=128

Neil Matatall

September 12, 2014
Tweet

More Decks by Neil Matatall

See All by Neil Matatall
E0fdc1036537c1308400fc8ba6e987b0?s=48 oreoshake
0
97
E0fdc1036537c1308400fc8ba6e987b0?s=48 oreoshake
0
85
E0fdc1036537c1308400fc8ba6e987b0?s=48 oreoshake
0
82
E0fdc1036537c1308400fc8ba6e987b0?s=48 oreoshake
0
150
E0fdc1036537c1308400fc8ba6e987b0?s=48 oreoshake
0
100
E0fdc1036537c1308400fc8ba6e987b0?s=48 oreoshake
2
160
E0fdc1036537c1308400fc8ba6e987b0?s=48 oreoshake
3
960

Other Decks in Programming

See All in Programming
Ff2c33d63aa8e06c90f4638c6266b4fb?s=48 sheharyar
1
410
5059d3f370ad7e1f4d8de4be79ae1a2c?s=48 rvirus0817
0
680
05a867429c5e5a2b4fe997b91bc98c11?s=48 taketo1024
0
130
1145fb026140c0af54cf49a9da6e79ee?s=48 stefanscheidt
0
120
F34964538565e89f55b1df6e33c9a1e8?s=48 kapsy1312
0
220
D661ba250e003e83b03c25852b27d3f8?s=48 0906koki
2
380
2e72046813bf3dc01173fe54919a6d1d?s=48 cc4966
3
260
D4b671ba3e441fa2aad85d7508ab67a2?s=48 treastrain
5
490
5e511bb6d01d856b4ec7a0e5b1f6a2f0?s=48 syumai
6
860
E66449b8260b07a1cf51c5ab5eaa8180?s=48 dunglas
3
2.9k
Cc8ec9594b83b5dc3c7eef345c05dc8d?s=48 shiz
6
1.1k
2594ac7ce91fd7d9a3ce71ca7cc2d0c0?s=48 d_date
8
1.2k

Featured

See All Featured
Bfd6b681ec6e8c9bef82ff0521c364f7?s=48 kastner
56
2k
6bb82b13cda86d3b821fa44100335ddf?s=48 thoeni
6
930
5f50f94346fbcb23706f0707169317a4?s=48 aarron
261
36k
C620790ae5bf5b50c245b2e0ef95f338?s=48 deanohume
294
28k
5b9fe87ec1faa67a4599782930f45ec9?s=48 sstephenson
149
12k
B6a8f005f39d23ffc930508ac9da68b9?s=48 vanstee
122
5.1k
96270e4c3e5e9806cf7245475c00b275?s=48 addyosmani
1352
200k
4262b9cfacfb6b2c77f23e1d0310cd3e?s=48 myddelton
110
11k
1b75d89772b7eea1f6c89fbf362607d9?s=48 moore
128
22k
170b760e0147792d0140e59ec78e9893?s=48 eitanlees
119
11k
Fde6c3a50ca518a909ef35c22c0ee0e4?s=48 destraynor
148
20k
0bce06bd06ee7a2c4f5500f25dcf7f18?s=48 paulrobertlloyd
74
1.6k

Transcript

  1. How CSP Will (maybe) Solve the XSS Problem Neil Matatall

    OWASP SD 4/17/2014

  2. Me • Twitter appsec engineer • I’m actually just a

    developer • In the business of going out of business • Sick and tired of fixing XSS

  3. XSS is so 1998

  4. So is XSS prevention

  5. What is XSS <input name=“id” value=“<%=id%>”>

  6. What is XSS ”><script>badStuff()</script>

  7. What is XSS <input name=“id” value=“”> <script>badStuff()</script> ”>

  8. What is XSS <script> var id=<%=id%>; </script>

  9. What is XSS 0;badStuff();

  10. What is XSS <script> var id=0; badStuff() </script>

  11. What is XSS <script> setInterval(1000, ‘<%=todo%>’) </script>

  12. What is XSS badStuff();

  13. What is XSS <script> setInterval(1000, ‘badStuff()’) </script>

  14. What is XSS <input name=“id” onBlur=“doStuff(<%=id %>)”>

  15. What is XSS ); badStuff(

  16. What is XSS <input name=“id” onBlur=“doStuff(); badStuff()”>

  17. What is XSS <a href=“<%=link%>”>Hi Mom!</a>

  18. What is XSS javascript:badThings()

  19. What is XSS <a href=“javascript:badThings()”> Hi Mom!</a>

  20. What is XSS <a href=“#” onClick=“doThing(‘<%=link%>’)”> Hi Mom! </a>

  21. What is XSS &#39;);badStuff(&#39;

  22. What is XSS <a href=“#” onClick= “doThing(‘&#39;);badStuff(&#39;’)” > Hi Mom!

    </a>

  23. What is XSS <a href=“#” onClick= “doThing(‘’);badStuff(‘’)”> Hi Mom! </a>

  24. What is DOM XSS <script> document.body.innerHTML = document.getElementById(‘name’).value; </script>

  25. What is DOM XSS

  26. What is DOM XSS <body> <img src=x onError=badThings()> </body>

  27. What is DOM XSS <script> var name = $(‘#name’).val $(‘body’).html(name)

    </script>

  28. What is DOM XSS

  29. What is DOM XSS <body> <img src=x onError=badThings()> </body>

  30. jQuery is XSS $(data)

  31. What is XSS <style> a { color: <%=usersFavoriteColor%>; } </style>

  32. What is XSS I dunno, something with SVG, CSS Expressions,

    etc. The list grows.

  33. Because Dr. Mario

  34. Because Dr. Mario

  35. Why do those crazy things?

  36. CODE != DATA “select * from table where id =

    “ + id “<a href=“ + link + “>text</a>”

  37. But we don’t do stupid things

  38. I will religiously escape content

  39. I will religiously escape content part 2

  40. JSFuck - Write any JavaScript with 6 Characters: []()!+ I

    will religiously escape content part 3
  41. None

  42. I’ll sanitize / validate input

  43. I’ll use a scanner

  44. I’ll perform periodic assessments

  45. Security is about layers

  46. None

  47. Thermos? Koozie?

  48. <script>goodStuff()</script> <script>badStuff()</script> How does the browser know?

  49. What is dangerous? • inline javascript • <script>…</script> • <input

    onBlur=“…”> • <a href=“javascript:…”> • on-the-fly code generation • setTimeout, eval, new Function(“…”)

  50. What’s a CSP??? default-src ‘self’; connect-src ‘self’; font-src ‘self’ data:;

    frame-src ‘self’ about: javascript:; frame-ancestors https://twitter.com; img-src https://mycdn.xom data:; media-src ‘https://mycdn.xom; object-src ‘none’; script-src https://mycdn.xom; style-src 'unsafe-inline' https://mycdn.xom; report-uri https://twitter.com/scribes/csp_report

  51. CSP is more than XSS protection

  52. Nothing is free

  53. Report-Only mode

  54. Techniques for removing inline javascript

  55. Removing the dangerous stuff

  56. CSP 1.1 • Whitelisting inline <script> in a safe way

  57. Inline code <script> stuff() </script>

  58. Nonces <script nonce=“34298734…”> stuff() </script>

  59. Hashes <script> stuff() </script>

  60. Hashes are more secure, and more limited than nonces

  61. What you still can’t do • Inline event handlers •

    <input onBlur=“doGoodThing()”> • <a href=“javascript:…”> • Dynamic javascript • <script> var id=<%=id%> </script> • Hash values won’t match • Nonce provides absolutely no security

  62. Automatic CSP Protection (Silverish bullet)

  63. Whitelisting javascript • Find all javascript • Compute all hash

    values • Whitelist scripts with corresponding hashes

  64. Assume: Sane web framework • Do a regular expression search

    over all templates, capture all inline javascript • Store a map of the hash(es) in each individual file • Each time the file is rendered, add the corresponding hashes to the header

  65. Developer productivity • Serve dynamic hash values in (!production), serve

    hardcoded hash values in production
  66. None