Identity Server Security Bug: Unsafe jQuery plugins

[alexhiggins732]

Identity Server Security Bug: Unsafe jQuery plugin

The original Identity Server 4 code base has several security bugs detected by CodeQL scanning violating this rule.

Description:

Library plugins, such as those for the jQuery library, are often configurable through options provided by the clients of the plugin. Clients, however, do not know the implementation details of the plugin, so it is important to document the capabilities of each option. The documentation for the plugin options that the client is responsible for sanitizing is of particular importance. Otherwise, the plugin may write user input (for example, a URL query parameter) to a web page without properly sanitizing it first, which allows for a cross-site scripting vulnerability in the client application through dynamic HTML construction.

Examples

Tool	Rule ID	Source
CodeQL	js/redos
/host/Quickstart/Account/AccountController.cs#L95-L9

 this.$target = $(this.options.target)

Issues

• Issue 75 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/75
• Issue 76 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/76
• Issue 77 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/77
• Issue 78 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/78
• Issue 79 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/79
• Issue 80 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/80
• Issue 81 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/81
• Issue 82 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/82
• Issue 83 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/83
• Issue 84 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/84
• Issue 85 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/85
• Issue 86 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/86
• Issue 87 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/87
• Issue 88 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/88
• Issue 89 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/89
• Issue 90 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/90
• Issue 91 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/91
• Issue 92 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/92
• Issue 93 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/93
• Issue 94 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/94
• Issue 95 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/95
• Issue 96 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/96
• Issue 97 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/97
• Issue 98 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/98
• Issue 99 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/99
• Issue 100 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/100
• Issue 101 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/101
• Issue 102 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/102
• Issue 103 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/103
• Issue 104 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/104
• Issue 105 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/105
• Issue 106 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/106
• Issue 107 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/107
• Issue 108 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/108
• Issue 109 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/109
• Issue 110 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/110

Recommendation

Document all options that can lead to cross-site scripting attacks, and guard against unsafe inputs where dynamic HTML construction is not intended.

Keep packages up to date with the latest distribution to patch previously discovered vulnerablites.

Review identified issues and guard against unsafe input for each issue.

Example

The following example shows a jQuery plugin that selects a DOM element, and copies its text content to another DOM element. The selection is performed by using the plugin option sourceSelector as a CSS selector.

jQuery.fn.copyText = function(options) {
	// BAD may evaluate `options.sourceSelector` as HTML
	var source = jQuery(options.sourceSelector),
	    text = source.text();
	jQuery(this).text(text);
}

This is, however, not a safe plugin, since the call to jQuery interprets sourceSelector as HTML if it is a string that starts with <.

Instead of documenting that the client is responsible for sanitizing sourceSelector, the plugin can use jQuery.find to always interpret sourceSelector as a CSS selector:

jQuery.fn.copyText = function(options) {
	// GOOD may not evaluate `options.sourceSelector` as HTML
	var source = jQuery.find(options.sourceSelector),
	    text = source.text();
	jQuery(this).text(text);
}

References

• OWASP: DOM based XSS Prevention Cheat Sheet.
• OWASP: XSS (Cross Site Scripting) Prevention Cheat Sheet.
• OWASP DOM Based XSS.
• OWASP Types of Cross-Site Scripting.
• Wikipedia: Cross-site scripting.
• jQuery: Plugin creation.
• Bootstrap: XSS vulnerable bootstrap plugins.
• Common Weakness Enumeration: CWE-79.
• Common Weakness Enumeration: CWE-116.