XSS best practices?

[Tim2842955474bi]

Hi, we are looking into better XSS (Cross-site scripting) prevention.

• We have the "Enable Global Script" protection checked in CFAdmin
• We have modified neo-security.xml to include a regex to remove various unwanted tags
• We have queryparamed all querys
• We are using getSafeHTML() when needed
• We are about to go in block mode behind a WAF

Does anyone have other recommendations? I couldn't find any recent posts about this in these forums. 

[pete_freitag · Accepted solution]

Yes, check out the encodeForHTML, and other functions starting with encodeFor. I wrote up a guide to XSS in ColdFusion here which goes into detail.

Beyond that - script protect is a trivial protection, I wouldn't rely on it for doing too much - there are many many ways around it.

The getSafeHTML function is also a good function, but it is best for cases when you know you have some legitimate HTML in the variable. If you shouldn't have HTML in a variable, (eg: name, phone number, etc) then use encodeForHTML instead.

Finally, great job adding cfqueryparam, but that is not going to help you with XSS, but it will help you with SQL Injection.

[Tim2842955474bi]

Thanks for reply, and that guide is very clear! I think there a small typo under the explanation of encodeForHTMLAttribute() though... the example uses encodeForHTML(). I think it's supposed to be encodeForHTMLAttribute().

[pete_freitag]

Thanks Tim - good catch - I have fixed that