What validations should be done post canonicalize function in ColdFusion to avoid XSS attack? - coldfusion

Question

We are working to avoid XSS attacks in a ColdFusion application. After adding <cfset this.scriptprotect=”all”> in our cfapplication tag, it worked only for the form input values which are now changed to InvalidTag. However it is not working for URL query string key values. Also I would like to know, why scriptprotect under the cfapplication tag is not working for URLs <script key insertion within the URL?
I come accross https://gist.github.com/learncfinaweek/4121370; I am including canonicalize in all pages for URL validations. I would like to know what are the validations that should be performed to avoid attacks post canonicalize function.

Answer 1

You cannot rely on CF exclusively for XSS (or sql injection) attacks. You could write your own code in application.cfc that will look for XSS/SQL Injection attacks in each of the scopes, and run that code in the onRequest() or onRequestStart() methods, depending on how your app is setup. Here's an example (please don't use this code without knowing exactly what it does and you've tested it extensively. This is some code I grabbed out of an app, but it's possible to get false positives and I'm not 100% confident with all the tests):
This code would be in application.cfc
public boolean function onRequestStart (
required string targetPage) {
try {
if (checkForAttack()) {
location url="/" addtoken=false;
return true;
}
... do other stuff ...
} catch (any e) {
onError(e, "onRequestStart");
}
return true;
} // onRequestStart()
private boolean function checkForAttack() {
// check for any kind of sql injection or xss attack
var attackFound = false;
// you could change these tests, or add more tests
var tests = ["4445434C415245", "cast(\s|%20)*(%28|\()", "(;|%3B)(\s|%20)*DECLARE", /*"exec(\s|%20)*\(",*/ "schema\.columns|table_name|column_name|drop(\s|%20)+table|insert(\s|%20)+into|\.tables", "\.\[sysobjects\]", "\.sysobjects"];
var ctTests = ArrayLen(tests);
var ix = 0;
var key = "";
if (isDefined("CGI.query_string") && CGI.query_string != "") {
for (ix = 1; ix <= ctTests; ix++) {
if (REFindNocase(tests[ix], CGI.query_string) > 0) {
CGI.query_string = "";
attackFound = true;
break;
}
}
}
if (isDefined("URL")) {
for (key in URL) {
for (ix = 1; ix <= ctTests; ix++) {
if (REFindNocase(tests[ix], URL[key]) > 0) {
attackFound = true;
URL[key] = "";
}
}
}
}
if (isDefined("Form")) {
for (key in Form) {
for (ix = 1; ix <= ctTests; ix++) {
if (reFindNocase(tests[ix], Form[key]) > 0) {
attackFound = true;
Form[key] = "";
}
}
}
}
if (IsDefined("Cookie")) {
for (key in Cookie) {
for (ix = 1; ix <= ctTests; ix++) {
if (REFindNocase(tests[ix], Cookie[key]) > 0) {
attackFound = true;
Cookie[key] = "";
}
}
}
}
return attackFound;
} // checkForAttack()