[Done 1.3.7.1] Cross-Site Scripting in 1.3.7

[avansant]

One of my clients has the latest zen but failed hackersafe's test regarding Cross-Site Scripting. On a few of her pages she has a text box for an attribute (customize your custom painted sign)
and apparently that is failing. They say we have to filter out the usual suspects (<>) etc.

Can anyone provide a easy way to do this for text attributes so she can get her official "please come and hack me, I dare you" symbol?

[rmullaney77]

One solution would be to pass every field's value through htmlentities on before handling the form data.

This is an untested example. I just wrote if off the top of my head.

foreach ($_POST as $key => $val) {
    if (is_array($val)) {
        foreach($val as $sub_key => $sub_val) {
            $_POST[$key][$sub_key] = htmlentities($sub_val, ENT_QUOTES);
        }
    } else {
        $_POST[$key] = htmlentities($val, ENT_QUOTES);
    }
} 

[TheOracle]

The example above is still a great one. However, to make sure you wish to remain between a-z and 0-9 characters, you could always replace the above with this one:

foreach ($_POST as $key => $val) {
  if (preg_match("/[a-z0-9\-\_\s]/i", $val)) {
    if (is_array($val)) {
        foreach($val as $sub_key => $sub_val) {
            $_POST[$key][$sub_key] = htmlentities($sub_val, ENT_QUOTES);
        }
    } else {
        $_POST[$key] = htmlentities($val, ENT_QUOTES);
    }
  } else {
  $messageStack->add('your_page_name_here', YOUR_TEXT_DEFINITION_NAME_HERE');
  } 

[avansant]

My programmer did the fix for me - added four lines to

index.php (in the main directory)

that seems to have done the trick:

# HackerSafe hack - Removes "WebApp Cross Site Scripting - 2" vulnerability
foreach($_POST as $var => $val) {
$_POST[$var]=preg_replace("/</",".", $val);
$_POST[$var]=preg_replace("/>/",".", $val);
}

hope that helps someone!

A

[TheOracle]

This could be done with:

$_POST[$var]=str_replace("<",".", $val);
$_POST[$var]=str_replace(">",".", $val); 

instead of preg_replace.

[DrByte]

The proper fix is posted here:
http://www.zen-cart.com/forum/showthread.php?t=64115