How badly should I try to prevent a user from XSSing themselves? The Next CEO of Stack OverflowHow to best defend against Targeted Attacks?How to prevent my website from getting malware injection attacks?CodeIgniter CSRF confusionHow to prevent XSS from urlHow do the Stack Exchange sites protect themselves from XSS?How to prevent data from Interception?Safely downloading user submitted contentShould we prevent this login XSS attack?How to prevent XSS in user-generated content (html) without disabling scripts and CSSa mysterious & pointless long-term hacking attempt?
Why do we say “un seul M” and not “une seule M” even though M is a “consonne”?
Incomplete cube
Why did the Drakh emissary look so blurred in S04:E11 "Lines of Communication"?
How does a dynamic QR code work?
Upgrading From a 9 Speed Sora Derailleur?
Is it possible to make a 9x9 table fit within the default margins?
Why can't we say "I have been having a dog"?
Can this transistor (2n2222) take 6V on emitter-base? Am I reading datasheet incorrectly?
Man transported from Alternate World into ours by a Neutrino Detector
What did the word "leisure" mean in late 18th Century usage?
Is the offspring between a demon and a celestial possible? If so what is it called and is it in a book somewhere?
Why does freezing point matter when picking cooler ice packs?
pgfplots: How to draw a tangent graph below two others?
How to implement Comparable so it is consistent with identity-equality
Salesforce opportunity stages
How can a day be of 24 hours?
My boss doesn't want me to have a side project
Are British MPs missing the point, with these 'Indicative Votes'?
Does the Idaho Potato Commission associate potato skins with healthy eating?
The sum of any ten consecutive numbers from a fibonacci sequence is divisible by 11
Read/write a pipe-delimited file line by line with some simple text manipulation
How seriously should I take size and weight limits of hand luggage?
How exploitable/balanced is this homebrew spell: Spell Permanency?
How do I keep Mac Emacs from trapping M-`?
How badly should I try to prevent a user from XSSing themselves?
The Next CEO of Stack OverflowHow to best defend against Targeted Attacks?How to prevent my website from getting malware injection attacks?CodeIgniter CSRF confusionHow to prevent XSS from urlHow do the Stack Exchange sites protect themselves from XSS?How to prevent data from Interception?Safely downloading user submitted contentShould we prevent this login XSS attack?How to prevent XSS in user-generated content (html) without disabling scripts and CSSa mysterious & pointless long-term hacking attempt?
Let's say a user can store some data in a web app. I'm now only talking about that sort of data the user can THEMSELVES view, not that is intended to be viewed by other users of the webapp. (Or if other users may view this data then it is handled to them in a more secure way.)
How horrible would it be to allow some XSS vulnerability in this data?
Of course, a purist's answer would clearly be: "No vulnerabilities are allowed". But honestly - why?
Everything that is allowed is the user XSSing THEMSELVES. What's the harm here? Other users are protected. And I can't see a reason why would someone mount an attack against themselves (except if it is a harmless one, in which case - again - no harm is done).
My gut feelings are that the above reasoning will raise some eyebrows... OK, then what am I failing to see?
xss attacks
asked 5 hours ago
gaazkamgaazkam
1,3162819
add a comment |
Let's say a user can store some data in a web app. I'm now only talking about that sort of data the user can THEMSELVES view, not that is intended to be viewed by other users of the webapp. (Or if other users may view this data then it is handled to them in a more secure way.)
How horrible would it be to allow some XSS vulnerability in this data?
Of course, a purist's answer would clearly be: "No vulnerabilities are allowed". But honestly - why?
Everything that is allowed is the user XSSing THEMSELVES. What's the harm here? Other users are protected. And I can't see a reason why would someone mount an attack against themselves (except if it is a harmless one, in which case - again - no harm is done).
My gut feelings are that the above reasoning will raise some eyebrows... OK, then what am I failing to see?
xss attacks
asked 5 hours ago
gaazkamgaazkam
1,3162819
How can you limit the scope of an XSS vuln to just some data? This is asking to open the door to everything getting compromised. Don't be lazy with it
– Crumblez
5 hours ago
add a comment |
Let's say a user can store some data in a web app. I'm now only talking about that sort of data the user can THEMSELVES view, not that is intended to be viewed by other users of the webapp. (Or if other users may view this data then it is handled to them in a more secure way.)
How horrible would it be to allow some XSS vulnerability in this data?
Of course, a purist's answer would clearly be: "No vulnerabilities are allowed". But honestly - why?
Everything that is allowed is the user XSSing THEMSELVES. What's the harm here? Other users are protected. And I can't see a reason why would someone mount an attack against themselves (except if it is a harmless one, in which case - again - no harm is done).
My gut feelings are that the above reasoning will raise some eyebrows... OK, then what am I failing to see?
xss attacks
asked 5 hours ago
gaazkamgaazkam
1,3162819
Let's say a user can store some data in a web app. I'm now only talking about that sort of data the user can THEMSELVES view, not that is intended to be viewed by other users of the webapp. (Or if other users may view this data then it is handled to them in a more secure way.)
How horrible would it be to allow some XSS vulnerability in this data?
Of course, a purist's answer would clearly be: "No vulnerabilities are allowed". But honestly - why?
Everything that is allowed is the user XSSing THEMSELVES. What's the harm here? Other users are protected. And I can't see a reason why would someone mount an attack against themselves (except if it is a harmless one, in which case - again - no harm is done).
My gut feelings are that the above reasoning will raise some eyebrows... OK, then what am I failing to see?
xss attacks
xss attacks
asked 5 hours ago
gaazkamgaazkam
1,3162819
asked 5 hours ago
gaazkamgaazkam
1,3162819
asked 5 hours ago
gaazkamgaazkam
1,3162819
asked 5 hours ago
gaazkamgaazkam
1,3162819
asked 5 hours ago
gaazkamgaazkam
1,3162819
1,3162819
How can you limit the scope of an XSS vuln to just some data? This is asking to open the door to everything getting compromised. Don't be lazy with it
– Crumblez
5 hours ago
add a comment |
How can you limit the scope of an XSS vuln to just some data? This is asking to open the door to everything getting compromised. Don't be lazy with it
– Crumblez
5 hours ago
How can you limit the scope of an XSS vuln to just some data? This is asking to open the door to everything getting compromised. Don't be lazy with it
– Crumblez
5 hours ago
How can you limit the scope of an XSS vuln to just some data? This is asking to open the door to everything getting compromised. Don't be lazy with it
– Crumblez
5 hours ago
add a comment |
2 Answers
2
active
oldest
votes
This is actually a real concept, "Self XSS" which is sufficiently common that if you open https://facebook.com and then open the developer tools, they warn you about it 
Obviously Facebook is a specific type of target and whether this issue matters to you or not, would depend on the exact nature of your site, but you may not be able to discount the idea of one user using social engineering techniques to get another user to attack themselves.
answered 4 hours ago
Rоry McCuneRоry McCune
52.7k13113187
add a comment |
Although you are right in that it might not matter so much from an attack point of view. From a usability point of view, the user might come across some 'unexpected behavior'. A while ago I used to have to work with software that had an obvious SQL injection problem (contractors couldn't/wouldn't fix it). This meant that unexpecting users would enter in something seemingly harmless such as their name "O'Brien", which would trigger an SQL injection and for computer illiterate people it was unexpected behavior. It is probably less likely with XSS, however consider the following if a user uses <> instead of () the data might seem to disappear. A proof of concept is below:
<html>
<head><title>HI</title></head>
<body>
<h1>WEBSITE</h1>
Hey my name is <travis>.
</body>
</html>
Note that when this website is rendered, the word 'travis', is not rendered.
answered 4 hours ago
meowcatmeowcat
1644
add a comment |
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "162"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
noCode: true, onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsecurity.stackexchange.com%2fquestions%2f206579%2fhow-badly-should-i-try-to-prevent-a-user-from-xssing-themselves%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
2 Answers
2
active
oldest
votes
2 Answers
2
active
oldest
votes
active
oldest
votes
active
oldest
votes
This is actually a real concept, "Self XSS" which is sufficiently common that if you open https://facebook.com and then open the developer tools, they warn you about it
Obviously Facebook is a specific type of target and whether this issue matters to you or not, would depend on the exact nature of your site, but you may not be able to discount the idea of one user using social engineering techniques to get another user to attack themselves.
answered 4 hours ago
Rоry McCuneRоry McCune
52.7k13113187
add a comment |
This is actually a real concept, "Self XSS" which is sufficiently common that if you open https://facebook.com and then open the developer tools, they warn you about it
Obviously Facebook is a specific type of target and whether this issue matters to you or not, would depend on the exact nature of your site, but you may not be able to discount the idea of one user using social engineering techniques to get another user to attack themselves.
answered 4 hours ago
Rоry McCuneRоry McCune
52.7k13113187
add a comment |
This is actually a real concept, "Self XSS" which is sufficiently common that if you open https://facebook.com and then open the developer tools, they warn you about it
Obviously Facebook is a specific type of target and whether this issue matters to you or not, would depend on the exact nature of your site, but you may not be able to discount the idea of one user using social engineering techniques to get another user to attack themselves.
answered 4 hours ago
Rоry McCuneRоry McCune
52.7k13113187
This is actually a real concept, "Self XSS" which is sufficiently common that if you open https://facebook.com and then open the developer tools, they warn you about it
Obviously Facebook is a specific type of target and whether this issue matters to you or not, would depend on the exact nature of your site, but you may not be able to discount the idea of one user using social engineering techniques to get another user to attack themselves.
answered 4 hours ago
Rоry McCuneRоry McCune
52.7k13113187
answered 4 hours ago
Rоry McCuneRоry McCune
52.7k13113187
answered 4 hours ago
Rоry McCuneRоry McCune
52.7k13113187
answered 4 hours ago
Rоry McCuneRоry McCune
52.7k13113187
52.7k13113187
add a comment |
add a comment |
Although you are right in that it might not matter so much from an attack point of view. From a usability point of view, the user might come across some 'unexpected behavior'. A while ago I used to have to work with software that had an obvious SQL injection problem (contractors couldn't/wouldn't fix it). This meant that unexpecting users would enter in something seemingly harmless such as their name "O'Brien", which would trigger an SQL injection and for computer illiterate people it was unexpected behavior. It is probably less likely with XSS, however consider the following if a user uses <> instead of () the data might seem to disappear. A proof of concept is below:
<html>
<head><title>HI</title></head>
<body>
<h1>WEBSITE</h1>
Hey my name is <travis>.
</body>
</html>
Note that when this website is rendered, the word 'travis', is not rendered.
answered 4 hours ago
meowcatmeowcat
1644
add a comment |
Although you are right in that it might not matter so much from an attack point of view. From a usability point of view, the user might come across some 'unexpected behavior'. A while ago I used to have to work with software that had an obvious SQL injection problem (contractors couldn't/wouldn't fix it). This meant that unexpecting users would enter in something seemingly harmless such as their name "O'Brien", which would trigger an SQL injection and for computer illiterate people it was unexpected behavior. It is probably less likely with XSS, however consider the following if a user uses <> instead of () the data might seem to disappear. A proof of concept is below:
<html>
<head><title>HI</title></head>
<body>
<h1>WEBSITE</h1>
Hey my name is <travis>.
</body>
</html>
Note that when this website is rendered, the word 'travis', is not rendered.
answered 4 hours ago
meowcatmeowcat
1644
add a comment |
Although you are right in that it might not matter so much from an attack point of view. From a usability point of view, the user might come across some 'unexpected behavior'. A while ago I used to have to work with software that had an obvious SQL injection problem (contractors couldn't/wouldn't fix it). This meant that unexpecting users would enter in something seemingly harmless such as their name "O'Brien", which would trigger an SQL injection and for computer illiterate people it was unexpected behavior. It is probably less likely with XSS, however consider the following if a user uses <> instead of () the data might seem to disappear. A proof of concept is below:
<html>
<head><title>HI</title></head>
<body>
<h1>WEBSITE</h1>
Hey my name is <travis>.
</body>
</html>
Note that when this website is rendered, the word 'travis', is not rendered.
answered 4 hours ago
meowcatmeowcat
1644
Although you are right in that it might not matter so much from an attack point of view. From a usability point of view, the user might come across some 'unexpected behavior'. A while ago I used to have to work with software that had an obvious SQL injection problem (contractors couldn't/wouldn't fix it). This meant that unexpecting users would enter in something seemingly harmless such as their name "O'Brien", which would trigger an SQL injection and for computer illiterate people it was unexpected behavior. It is probably less likely with XSS, however consider the following if a user uses <> instead of () the data might seem to disappear. A proof of concept is below:
<html>
<head><title>HI</title></head>
<body>
<h1>WEBSITE</h1>
Hey my name is <travis>.
</body>
</html>
Note that when this website is rendered, the word 'travis', is not rendered.
answered 4 hours ago
meowcatmeowcat
1644
answered 4 hours ago
meowcatmeowcat
1644
answered 4 hours ago
meowcatmeowcat
1644
answered 4 hours ago
meowcatmeowcat
1644
1644
add a comment |
add a comment |
Thanks for contributing an answer to Information Security Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsecurity.stackexchange.com%2fquestions%2f206579%2fhow-badly-should-i-try-to-prevent-a-user-from-xssing-themselves%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
How can you limit the scope of an XSS vuln to just some data? This is asking to open the door to everything getting compromised. Don't be lazy with it
– Crumblez
5 hours ago