How do you fight against all these ways? -Javascript and its million different ways you can write it

Question

I just don't know what to think anymore. It seems like the people who made javascript went out of their way to allow it to be written a million different ways so hackers can have a field day.

I finally got my white list up by using html agility pack. It should remove

<scrpit></script>

As it is not in my white list plus any onclick,onmouse and etc.

However now it seems you can write javascript in the attribute tags.

<IMG SRC="javascript:alert('hi');">

and since I allow SRC attributes my white list can't help me on this. So I came up with the idea to go through all valid attributes at the end and look inside them.

So it would find all my allowed attributes for every html tag( so src,href and etc).

I then found the innertext and put it to lowercase. I then did a index check on this string for "javascript".

If an index was found I started at that index and removed every character from that index on. So in the above case the attribute would be left with Src="".

Now it seems that is not good enough since you can do something like

java script jav ascript

and probably a space between every letter.

So I don't know how to stop it. If it was just a space between java and script then I could just write a simple regex that did not care how many spaces between. But if it is really that you can put a space or tab or whatever after each letter then I have no clue.

Then to top it off you can do all these other great ways too

   <IMG SRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;> // will work apparently
    <IMG SRC=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041> // will work apparently
    <IMG SRC="jav    ascript:alert('XSS');"> // will work apparently
    <IMG SRC="jav&#x09;ascript:alert('XSS');">// will work apparently
    <IMG SRC="jav&#x0A;ascript:alert('XSS');"> // will work apparently
    <IMG SRC="jav&#x0D;ascript:alert('XSS');"> // will work apparently

http://ha.ckers.org/xss.html

I know this is for some cross scripting attack( I am not making an XSS asp.net mvc does a good job of this already) but I don't see why it can't be use for other things like like in all those examples it makes alerts so it could be used for something else.

So I have no clue how to check and remove any of these.

I am using C# but I don't know how to stop any of these and don't know of anything in C# that could help me out.

Answer 1

Seems you want to clean out javascript, and for that there is in fact a nice solution for you in C#/.Net.

Download Microsoft Web Protection Library from CodePlex.

If you run your html fragment thru Microsoft.Security.Application.AntiXss.GetSafeHtmlFragment(html) then you will end up with this output:

<img src=""> // will work apparently
<img src=""> // will work apparently
<img src=""> // will work apparently
<img src="">// will work apparently
<img src=""> // will work apparently
<img src=""> // will work apparently

All script cleaned out.