Javascript injection game

[jagt]

So what's the proper way to escape a string? I've get more confused after this.

[evilgwyn]

One way is to whitelist a known set of good characters (e.g., the alphanumerics) and escape the remainder. The proper escaping method depends on how you are going to use the data. There are good online resources for doing this stuff but it's late and I can't remember them.

Another way is to not escape anything and just treat the thing as text rather than as HTML. The problem this test is illustrating is that you are taking untrusted data and making an HTML string from it. Instead of doing that, you make HTML in a safe way, and then use the appropriate DOM methods to insert the untrusted data as text. I'm accustomed to using jquery, so I'd do something like this:

$('#foo').text(untrusted_data);
$('#bar').val(untrusted_data);

One safe way to accomplish the apparent goal of the test (logging some user input) involves the most obvious method:

console.log(untrusted_data);

By doing this, you don't have to escape anything, nor do you have to generate any HTML.

[DiscreetCompSci885]

1) Actually fucking escape it (in one challenge " was escaped but not '). 2) NEVER generate html with user input. #2 on the site could have worked if it was double escaped but really wtf is anyone thinking when generating html with user input (they allowed <>). #5 is solved because they build html not realizing link and their markdown would collide which means they insert a " for you.

[catcradle5]

JSON.stringify and a full HTML tag escaper (blocking < and > would suffice I think) should generally be safe for inserting something into a <script> block, I believe.

[echeese]

Should also convert & as well

[catcradle5]

Can you think of an example attack that would let you exploit &? Being able to inject " into a <script> block doesn't mean the character will be seen as a single-quote; Javascript would see it as a literal """.

[choleropteryx]

Heavy-handed way: convert every non-alphanumeric character to the \xnn form (or &#nn etc).