-
Notifications
You must be signed in to change notification settings - Fork 57
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Xss validator not allowing having < and > characters in request body #206
Comments
Hey, that is an interesting finding! Have you tried using whitelist option? https://github.com/leizongmin/js-xss/blob/master/README.md It is using some default whitelist so maybe you will be able to override it somehow. We can also try to add some custom filters here that would change the behavior of the default filters by XSS package. |
@Baroshem Thank you for your reply. I should be able to use whitelist to whitelist certain tags but in my case it's just < and > characters which cause the issue. Same happens if I submit unknown HTML tag. I would expect that xss validator would encode < and > characters as mentioned here but it doesn't happen 🤔 By default it should escape the tag. But in my case the error is being thrown and I'm not able to save the data. |
Actually I just added the following config to test out whitelist functionality:
What happens now is that if I try to submit any HTML tag other than |
I believe the problem is located here:
If the input string contains a tag, < or > character, and this tag is not whitelisted (or in default whitelist), it will be encoded by xss validator using default escapeHTML function. So the processed value will always be different that the initial value, and the error will be thrown. |
Hey @dariasamo Interesting finding. Would you be interested in creating a pull request with your proposition for change? I could then test it out to see if it can be added to the next release :) |
Sure, I just need to understand when and if the error has to be thrown. Right now it happens whenever the the values don't match, which I think shouldn't be the case since the sanitized input will differ from the initial one. So I guess I don't totally understand the purpose of the error 🤔 |
The general idea was to to throw an error once the passed value in either body or query contains some values that are sanitized by XSS Library. To solve your isse and do not break the existing functionality, I would recommend to create some custom filters that will be triggered before the xss package as it is an external dependency that we cannot modify that easily. Maybe we could create some additional logic that would alter the query and body so that once it contains one char of < or > it will do something with the input so that it is not sanitized by the XSS pckage? Then it would fix your issue and wont stop how it works for other users. |
Hi @Baroshem thank you for the explanation. My understanding was different before as I expected no error to be thrown if the input was sanitized by xss library. I think I have one more unclear point in this integration not related to my previous use case. In case the error is thrown each time the value is sanitized, what is the point of
And what would happen if I manage to disable the error to be thrown, how should I proceed if I want to post the sanitized input to API? Let's say with the following config:
and input:
I expect the tags to be filtered out. If I don't have error disabled, I still get an error and cannot proceed. If I can disable an error, I would still not be able to do anything with the sanitized input, or am I missing something? Thank you |
Hey, The case with requestSizeLimiter is a bug (typo when I was implementing throwError functionality for all middlewares). I will fix it in the upcoming 1.0.0-rc.1 version. The throw error functionality is related to the fact that by default Nuxt has its own design for errors (custom style). The throwError allows you as a user to get the error object as a return value and just react to it with your custom error page. |
Hey, yes the throw error functionality is clear but it is still not clear what I can do if I enable |
If you need any assistance from my side, just let me know :) |
Heyo, any progress here? I think this could be useful for the upcoming 1.0.0 release :) |
Hi @Baroshem I had 2 ideas in mind when trying to tackle this issue:
This solution is not bullet-proof and I can imagine there will be some edge cases, when this might not work.
In the end we decided to simply disallow using such characters, add some FE validation and keep the middleware functionality as is. |
What do you think about adding a new property to the error object (i.e. |
|
|
|
|
Hey @dariasamo Sorry for no contact from my side. I was quite busy with work stuff. Could you prepare a Proof of Concept PR with the solution that would solve the issue you mentioned? I would like to try it out and see how we can make it part of the module :) |
Would you like to work on it? :) |
Closing due to no further contact from the issue author. If this will be needed again, please let me know and I will reopen the issue :) |
What is actually happening?
This issue is similar to Error when sending FormData #147. The same error is being thrown when there is a request to nuxt api with request body containing
>
and<
characters. For example:Organization name>
. It looks like parsing it through the validator causes this problem. SendingOrganization <a>name
is parsed correctly. Disabling xss validator middleware solves this problem but I was wondering if it can accept single<
or>
characters without disabling the whole xss validation functionality?Version
nuxt-security: v0.14.4
nuxt: v3.5.3
Steps to reproduce
Send a request to nuxt api with request body containing
<
or>
or both characters but not a valid HTML tag which are supported.The text was updated successfully, but these errors were encountered: