Eclipse Community Forums: Remote Application Platform (RAP)

Home » Eclipse Projects » Remote Application Platform (RAP) » RAP and Anti XSS features

RAP and Anti XSS features [message #1703398]

Fri, 31 July 2015 05:42

Eclipse User

Hi,

I have been working with RAP for some time now and I am wondering how RAP is coping with cross site scripting attack vectors in general, and also specifically JSON injection.

I have tried a few vectors and it seems to behave nicely. Apparently no need to sanitize inputs. The rendering seems also to be fine even when some tags or malicious script is stored and retrieved from the DB to be put in a page.

Does it mean RAP is already actively handling those threats ?
How does it work ? What risks are covered ?

Many thanks.

Re: RAP and Anti XSS features [message #1703608 is a reply to message #1703398]

Mon, 03 August 2015 11:38

Eclipse User

All content that is displayed in the browser must have been set using an
API method such as Label.setText(). All these methods encode their
input, so that any malicious content would only be printed instead of
evaluated. Markup-enabled widgets parse the texts and ensure that only a
defined subset of HTML elements is used.

I believe that this application model makes RAP pretty safe against the
typical exploits. However, we're not security experts here and we rely
on the community to point out issues. For example, just recently we've
closed an issue [1] regarding unlikely but possible CSRF [2] attacks. If
you have questions or concerns about other security threats, please let
us know.

Regards,
Ralf

[1] https://bugs.eclipse.org/bugs/show_bug.cgi?id=413668
[2] https://en.wikipedia.org/wiki/Cross-site_request_forgery

--
Ralf Sternberg

Twitter: @EclipseRAP
Blog: http://eclipsesource.com/blogs/

Professional services for RAP and RCP?
http://eclipsesource.com/services/rap/

Re: RAP and Anti XSS features [message #1704873 is a reply to message #1703608]

Mon, 10 August 2015 05:25

Eclipse User

Thanks for this.

Yes I have a particular point that might be interesting in that perspective.
In rap-client.js I can see that this function might be a risk:

   _configRequest : function() {
      if( !Client.isWebkit() ) {
       this._request.setRequestHeader( "Referer", window.location.href );
      }
      var contentType = "application/json; charset=UTF-8";
      this._request.setRequestHeader( "Content-Type", contentType );
      if( this._shouldUseStateListener() ) {
        this._request.onreadystatechange = rwt.util.Functions.bind( this._onReadyStateChange, this );
      }
    },

Don't you think this ( this._request.setRequestHeader( "Referer", window.location.href );) could allow an attacker to cause the user to perform unintended actions by using a DOM-based Ajax request header manipulation ?
Data is read from window.location.href and used to alter the header. Is that header used by RAP (server-side) in a way that could alter it's behaviour ?

Many thanks.

Re: RAP and Anti XSS features [message #1714535 is a reply to message #1704873]

Fri, 13 November 2015 07:43

Eclipse User

Allow me to up this topic.

After looking in the RAP sources, I couldn't find a use of the 'Referer' header anywhere.
I also ran tests using a patched org.eclipse.rap.rwt\bin\rwt\remote\Request.js having this line

this._request.setRequestHeader( "Referer", window.location.href );

commented out and our application deployed, and I could see no impact.

Seeing this, I would assume that header is not used.

Could you please confirm or deny this assumption ?

Regards,
Paul.

Re: RAP and Anti XSS features [message #1714537 is a reply to message #1714535]

Fri, 13 November 2015 08:03

Eclipse User

Hi,
yes... to my knowledge the "Referer" header is not used by the RAP
framework.
Regards,
Ivan

--
Ivan Furnadjiev

Twitter: @EclipseRAP
Blog: http://eclipsesource.com/blogs/

Professional services for RAP and RCP?
http://eclipsesource.com/services/rap/

Re: RAP and Anti XSS features [message #1714973 is a reply to message #1703398]

Wed, 18 November 2015 03:54

Eclipse User

The issue has been fixed: https://git.eclipse.org/r/#/c/60686/

Thanks again!

Previous Topic:	DND to external Javascript Application
Next Topic:	collection of css

Goto Forum:

-=] Back to Top [=-

Current Time: Sun Jul 20 03:12:26 EDT 2025

.:: Contact :: Home ::.

Breadcrumbs

Sign up to our Newsletter