Mrthfx

Oldie but Goldie

Compensation for working overtime on Saturdays

Find the majority element, which appears more than half the time

What is the difference between 'contrib' and 'non-free' packages repositories?

MT "will strike" & LXX "will watch carefully" (Gen 3:15)?

Calculating discount not working

logical reads on global temp table, but not on session-level temp table

How seriously should I take size and weight limits of hand luggage?

How does a dynamic QR code work?

How to implement Comparable so it is consistent with identity-equality

Traveling with my 5 year old daughter (as the father) without the mother from Germany to Mexico

Do I need to write [sic] when including a quotation with a number less than 10 that isn't written out?

Would a grinding machine be a simple and workable propulsion system for an interplanetary spacecraft?

My ex-girlfriend uses my Apple ID to login to her iPad, do I have to give her my Apple ID password to reset it?

Free fall ellipse or parabola?

Why do we say “un seul M” and not “une seule M” even though M is a “consonne”?

My boss doesn't want me to have a side project

How to pronounce fünf in 45

Does the Idaho Potato Commission associate potato skins with healthy eating?

Finitely generated matrix groups whose eigenvalues are all algebraic

Why doesn't Shulchan Aruch include the laws of destroying fruit trees?

What does this strange code stamp on my passport mean?

Masking layers by a vector polygon layer in QGIS

Can this transistor (2N2222) take 6 V on emitter-base? Am I reading the datasheet incorrectly?

How badly should I try to prevent a user from XSSing themselves?

2

Let's say a user can store some data in a web app. I'm now only talking about that sort of data the user can THEMSELVES view, not that is intended to be viewed by other users of the webapp. (Or if other users may view this data then it is handled to them in a more secure way.)

How horrible would it be to allow some XSS vulnerability in this data?

Of course, a purist's answer would clearly be: "No vulnerabilities are allowed". But honestly - why?

Everything that is allowed is the user XSSing THEMSELVES. What's the harm here? Other users are protected. And I can't see a reason why would someone mount an attack against themselves (except if it is a harmless one, in which case - again - no harm is done).

My gut feelings are that the above reasoning will raise some eyebrows... OK, then what am I failing to see?

xss attacks

share|improve this question

asked 7 hours ago

gaazkamgaazkam

1,3162819

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  How can you limit the scope of an XSS vuln to just some data? This is asking to open the door to everything getting compromised. Don't be lazy with it
  
  – Crumblez
  7 hours ago
  

  
  
  
  

add a comment | 

2

Let's say a user can store some data in a web app. I'm now only talking about that sort of data the user can THEMSELVES view, not that is intended to be viewed by other users of the webapp. (Or if other users may view this data then it is handled to them in a more secure way.)

How horrible would it be to allow some XSS vulnerability in this data?

Of course, a purist's answer would clearly be: "No vulnerabilities are allowed". But honestly - why?

Everything that is allowed is the user XSSing THEMSELVES. What's the harm here? Other users are protected. And I can't see a reason why would someone mount an attack against themselves (except if it is a harmless one, in which case - again - no harm is done).

My gut feelings are that the above reasoning will raise some eyebrows... OK, then what am I failing to see?

xss attacks

share|improve this question

asked 7 hours ago

gaazkamgaazkam

1,3162819

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  How can you limit the scope of an XSS vuln to just some data? This is asking to open the door to everything getting compromised. Don't be lazy with it
  
  – Crumblez
  7 hours ago
  

  
  
  
  

add a comment | 

Let's say a user can store some data in a web app. I'm now only talking about that sort of data the user can THEMSELVES view, not that is intended to be viewed by other users of the webapp. (Or if other users may view this data then it is handled to them in a more secure way.)

How horrible would it be to allow some XSS vulnerability in this data?

Of course, a purist's answer would clearly be: "No vulnerabilities are allowed". But honestly - why?

Everything that is allowed is the user XSSing THEMSELVES. What's the harm here? Other users are protected. And I can't see a reason why would someone mount an attack against themselves (except if it is a harmless one, in which case - again - no harm is done).

My gut feelings are that the above reasoning will raise some eyebrows... OK, then what am I failing to see?

xss attacks

share|improve this question

asked 7 hours ago

gaazkamgaazkam

1,3162819

share|improve this question

asked 7 hours ago

gaazkamgaazkam

1,3162819

share|improve this question

asked 7 hours ago

gaazkamgaazkam

1,3162819

asked 7 hours ago

gaazkamgaazkam

1,3162819

asked 7 hours ago

gaazkamgaazkam

1,3162819

2 Answers
2

active

oldest

votes

4

This is actually a real concept, "Self XSS" which is sufficiently common that if you open https://facebook.com and then open the developer tools, they warn you about it

Obviously Facebook is a specific type of target and whether this issue matters to you or not, would depend on the exact nature of your site, but you may not be able to discount the idea of one user using social engineering techniques to get another user to attack themselves.

share|improve this answer

answered 6 hours ago

Rоry McCuneRоry McCune

52.7k13113187

add a comment | 

0

Although you are right in that it might not matter so much from an attack point of view. From a usability point of view, the user might come across some 'unexpected behavior'. A while ago I used to have to work with software that had an obvious SQL injection problem (contractors couldn't/wouldn't fix it). This meant that unexpecting users would enter in something seemingly harmless such as their name "O'Brien", which would trigger an SQL injection and for computer illiterate people it was unexpected behavior. It is probably less likely with XSS, however consider the following if a user uses <> instead of () the data might seem to disappear. A proof of concept is below:

<html>

    <head><title>HI</title></head>

    <body>

        <h1>WEBSITE</h1>

        Hey my name is <travis>.

    </body>

</html>

Note that when this website is rendered, the word 'travis', is not rendered.

share|improve this answer

answered 6 hours ago

meowcatmeowcat

1644

add a comment | 

StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "162"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});

function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
noCode: true, onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});


}
});

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Sign up using Google

Sign up using Facebook

Sign up using Email and Password

Post as a guest

Name

Email

Required, but never shown

StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsecurity.stackexchange.com%2fquestions%2f206579%2fhow-badly-should-i-try-to-prevent-a-user-from-xssing-themselves%23new-answer', 'question_page');
}
);

Post as a guest

Name

Email

Required, but never shown

4

This is actually a real concept, "Self XSS" which is sufficiently common that if you open https://facebook.com and then open the developer tools, they warn you about it

Obviously Facebook is a specific type of target and whether this issue matters to you or not, would depend on the exact nature of your site, but you may not be able to discount the idea of one user using social engineering techniques to get another user to attack themselves.

share|improve this answer

answered 6 hours ago

Rоry McCuneRоry McCune

52.7k13113187

add a comment | 

4

This is actually a real concept, "Self XSS" which is sufficiently common that if you open https://facebook.com and then open the developer tools, they warn you about it

Obviously Facebook is a specific type of target and whether this issue matters to you or not, would depend on the exact nature of your site, but you may not be able to discount the idea of one user using social engineering techniques to get another user to attack themselves.

share|improve this answer

answered 6 hours ago

Rоry McCuneRоry McCune

52.7k13113187

add a comment | 

This is actually a real concept, "Self XSS" which is sufficiently common that if you open https://facebook.com and then open the developer tools, they warn you about it

Obviously Facebook is a specific type of target and whether this issue matters to you or not, would depend on the exact nature of your site, but you may not be able to discount the idea of one user using social engineering techniques to get another user to attack themselves.

share|improve this answer

answered 6 hours ago

Rоry McCuneRоry McCune

52.7k13113187

share|improve this answer

answered 6 hours ago

Rоry McCuneRоry McCune

52.7k13113187

answered 6 hours ago

Rоry McCuneRоry McCune

52.7k13113187

answered 6 hours ago

Rоry McCuneRоry McCune

52.7k13113187

0

Although you are right in that it might not matter so much from an attack point of view. From a usability point of view, the user might come across some 'unexpected behavior'. A while ago I used to have to work with software that had an obvious SQL injection problem (contractors couldn't/wouldn't fix it). This meant that unexpecting users would enter in something seemingly harmless such as their name "O'Brien", which would trigger an SQL injection and for computer illiterate people it was unexpected behavior. It is probably less likely with XSS, however consider the following if a user uses <> instead of () the data might seem to disappear. A proof of concept is below:

<html>

    <head><title>HI</title></head>

    <body>

        <h1>WEBSITE</h1>

        Hey my name is <travis>.

    </body>

</html>

Note that when this website is rendered, the word 'travis', is not rendered.

share|improve this answer

answered 6 hours ago

meowcatmeowcat

1644

add a comment | 

0

Although you are right in that it might not matter so much from an attack point of view. From a usability point of view, the user might come across some 'unexpected behavior'. A while ago I used to have to work with software that had an obvious SQL injection problem (contractors couldn't/wouldn't fix it). This meant that unexpecting users would enter in something seemingly harmless such as their name "O'Brien", which would trigger an SQL injection and for computer illiterate people it was unexpected behavior. It is probably less likely with XSS, however consider the following if a user uses <> instead of () the data might seem to disappear. A proof of concept is below:

<html>

    <head><title>HI</title></head>

    <body>

        <h1>WEBSITE</h1>

        Hey my name is <travis>.

    </body>

</html>

Note that when this website is rendered, the word 'travis', is not rendered.

share|improve this answer

answered 6 hours ago

meowcatmeowcat

1644

add a comment | 

Although you are right in that it might not matter so much from an attack point of view. From a usability point of view, the user might come across some 'unexpected behavior'. A while ago I used to have to work with software that had an obvious SQL injection problem (contractors couldn't/wouldn't fix it). This meant that unexpecting users would enter in something seemingly harmless such as their name "O'Brien", which would trigger an SQL injection and for computer illiterate people it was unexpected behavior. It is probably less likely with XSS, however consider the following if a user uses <> instead of () the data might seem to disappear. A proof of concept is below:

<html>

    <head><title>HI</title></head>

    <body>

        <h1>WEBSITE</h1>

        Hey my name is <travis>.

    </body>

</html>

Note that when this website is rendered, the word 'travis', is not rendered.

share|improve this answer

answered 6 hours ago

meowcatmeowcat

1644

<html>

    <head><title>HI</title></head>

    <body>

        <h1>WEBSITE</h1>

        Hey my name is <travis>.

    </body>

</html>

share|improve this answer

answered 6 hours ago

meowcatmeowcat

1644

answered 6 hours ago

meowcatmeowcat

1644

answered 6 hours ago

meowcatmeowcat

1644