to_json cross site scripting security issue (XSS)

"Because to_json does not escape its values"

What leads you to that conclusion? Escaping of strings in JSON happens here: http://dev.rubyonrails.org/browser/trunk/activesupport/lib/active_support/json/encoders/string.rb

Also, I'm unable to recreate an XSS exploit through your example:

x = <<END
TEST"}}; alert('XSS!!') ;a={{"
END
client = {:attributes => {:name => x}}
puts client.to_json

returns

{attributes: {name: "TEST\"}}; alert('XSS!!') ;a={{\"\n"}}

with the embedded quotes escaped, as expected.

Please reopen if you're able to provide a full test case.

My example was to simple. I'll attach a proof of concept. Follow the steps in the README. Tested it with two people on Rails 1.2.3.

TO JSON XSS Exploit proof of concept

Howto: Untar Attachment Check config/database.yml Create MYSQL DATABASE json_xss_dev rake db:migrate to create the client table ruby script/server to start the application

Head via your browser to: 0.0.0.0:3000 Head to /clients

Add a few names, visit the xss page (/clientxss) Take a look at the source, you'll see your names in the javascript client variable.

Add a new client by copy-pasting the textarea contents into the the firstname or lastname field

Head to /clients, this should work perfectly Head to /clientxss, this should result in a popup saying XSS

Being one of the two people who tested this, I've simplified the input string to the following:

</SCRIPT><SCRIPT>alert('XSS')</SCRIPT>

The problem lies in the fact that the attributes are merely escaped, which is not enough. PHP (Zend) and Java use HTMLEntities for this, which is probably preferable.

var clients = <%=h @clients.to_json %>;

Actually, that doesn't work because javascript doesn't decode the string. Use html comments instead:

<script type="text/javascript">
<!--
ar clients = <%= @clients.to_json %>;
-->
</script>

Don't you mean:

<script type="text/javascript">
<!--
var clients = <%= h @clients.to_json %>;
-->
</script>

No. You don't want to sanitize it, because the clients string will have encoded tags in the content, and not the actual content.

Oh, did you mean the 'ar clients' part? Heh, I suck at copy/paste obviously.

Also, JS may want the html comment tags commented out.

<script type="text/javascript">
//<!--
var clients = <%= @clients.to_json %>;
//-->
</script>

Using h to sanitize is off course impossible, as that would mangle the json array, making it useless. The comment 'hack' in javascript is both ugly and not preventing the XSS.

The only real solution is to use htmlentities or escaping for the value fields.

And please look at the attached proof of concept, the original message is wrong as my example was too simple.

I did look at it, and it didn't pop up for me once I added the comments.

I just added the comment and inserted the full length exploit string in both the firstname and lastname. I gave me an instant popup (Firefox 2.0.0.3). The comment does not help because the exploit string can contain an end comment string.

Reopen

Ok that makes sense. Browsers suck.

this patch works (edge rails): http://pastie.caboo.se/65550.txt

Using this to test it:

<script type="text/javascript">
var foo = <%= {:a => "</script><script>alert('hello')</script>"}.to_json %>
</script>

committed [6893]. if it causes issues, please open a new ticket w/ a failing test case + patch.

I'll test it tonight, after work :)

If someone wants to throw in a patch for these failures, you'd be my best friend forever. It's late.

http://cruisecontrolrb.thoughtworks.com/builds/RubyOnRails/6893

(In [6894]) fix test cases to match new json output. Closes #8371

Checked with edge (9606). Seems to be fixed.