From the developer’s perspective
For AS Java, the encoding is available as tc_sec_csi.jar. There is a static class and an interface which provides the encodings for HTML/XML, JavaScript, CSS and URL. Also it is available to use methods of public class StringUtils (com.sap.security.core.server.csi.util.StringUtils):
- escapeScriptEndTag(String pStr) - Prepare a string to be used for a javascript string definition with particular care about script tag;
- escapeScriptEndTag(StringBuffer sb, String pStr)- Prepare a string to be used for a javascript string definition with particular care about script tag.
- escapeSpace(String input) - Encode a space with + Note that this function will call 'disableScriptSignatures'.
- escapeToAttributeValue(String input) - Encode a string for output as an attribute string of a tag, no URLs!
- escapeToAttributeValue(StringBuffer sb, String input, int maxLength) - Encode a string for output as an attribute string of a tag, no URLs!
- escapeToAttributeValue(String input, int maxLength) - Encode a string for output as an attribute string of a tag, no URLs!
- escapeToHTML(String input) - Encode a string for output between tags (CASE1)
- escapeToHTML(StringBuffer sb, String input, int maxLength) - Encode a string for output between tags (CASE1)
- escapeToHTML(String input, int maxLength) - Encode a string for output between tags (CASE1)
- escapeToJS(String input) - Encode a string inside a JS string declaration (CASE5)
- escapeToJS(StringBuffer sb, String input, int maxLength) - Encode a string inside a JS string declaration (CASE5)
- escapeToJS(String input, int maxLength) - Encode a string inside a JS string declaration (CASE5)
- escapeToURL(String input) - Encode a string that represents a URL (CASE3) Note that this function will call 'disableScriptSignatures'.
- escapeToURL(StringBuffer sb, String input, int maxLength) - Encode a string that represents a URL (CASE3) Note that this function will call 'disableScriptSignatures'.
- escapeToURL(String input, int maxLength) - Encode a string that represents a URL (CASE3) Note that this function will call 'disableScriptSignatures'.
- urlEncode(String s) - A trivial replacement of URLEncoder.encode
- urlEncode(StringBuffer sb, String s, char[] forceEncode) - This is an extended version of the URLEncoder.encode method.
- urlEncode(String s, char[] forceEncode) - This is an extended version of the URLEncoder.encode method.
CASE1 (Output BETWEEN tags)
<head>
<title>[CASE1]</title>
</head>
<table>
<tr>
<td>Username</td>
<td>[CASE1]</td>
</tr>
</table>
CASE2 (Output INSIDE tags, but output is not a URL)
<form name="CASE2">
<input type="text" name="user" value="[CASE2]">
<input type="text" name="user" value='[CASE2]'>
</form>
<a name="[CASE2]">Click here</a>
CASE3 (Output is a URL)
<a href="CASE3" style="[CASE3]"><img src="[CASE3]"
lowsrc="[CASE3]"></a>
CASE4 (Output inside a SCRIPT context, but output is not a string declaration)
<script>
var a = [CASE4];
[CASE4];
</script>
CASE5 (Output is a string declaration in a script)
<script>
var a = '[CASE5]';
alert("[CASE5]");
</script>
The class name is XSSEncoder (class name with package name: com.sap.security.core.server.csi.XSSEncoder).
The interface is IXSSEncoder(interface with package name: com.sap.security.core.server.csi.IXSSEncoder). The interface can be retrieved with com.sap.security.core.server.csi.XSSEncoder.getInstance().
The class XSSEncoder and the interface IXSSEncoder are the successors of the class StringUtils (see SAP Security Note 866020 [10] and its update Note 1601461 [11]), so the same dependencies have to be fulfilled, for example, a runtime reference to the J2EE library security.class or tc/bl/security/lib and a compiler reference to tc_sec_csi.jar.
Context Method
| HTML / XML | out = XSSEncoder.encodeHTML( in ) and XSSEncoder.encodeXML( val ); |
| JavaScript | out = XSSEncoder.encodeJavaScript( val ); |
| URL | out = XSSEncoder.encodeURL( val ); |
| CSS | out = XSSEncoder.encodeCSS( val ); |
For information about the delivery of these extensions, see SAP Security Note 1590008 [12].
WebDynpro Java
For WebDynpro Java, you do not have to care about XSS. The security is ensured through the framework itself.
SAP UI Development Kit for HTML5
For the SAP UI Development Kit for HTML5, the encoding functions are implemented as a jQuery plug-in in framework/_core/src/main/js/jquery.sap.encoder.js.
The functions to use for the different contexts are:
| HTML / XML | jQuery.sap.encodeHTML(sValue) and jQuery.sap.encodeXML(sValue) |
| JavaScript | jQuery.sap.encodeJS(sValue) |
| URL | jQuery.sap.encodeURL(sValue) |
| CSS | jQuery.sap.encodeCSS(sValue) |
From the administrator’s perspective
The administrator has to set the parameters to improve security:
- Global_app_config/session_config/sessionTimeout = 900. Enable session timeout to minimize potential attack window.
- SystemCookiesDataProtection = true. Declaring a cookie as HttpOnly increases the security of your system because it eliminates access to this cookie in the Web browser from client-side scripts, applets, plugins, and the like. Set httpOnly flag to secure cookies from transmitting them into the malicious host using XSS vulnerability.
- ume.logon.httponlycookie= True. Logon tickets are cookies that are used for user authentication and Single Sign-On in J2EE Engine. Value “True” means that the session information can be transmitted only by HTTP and obtaining of cookies using document.cookie (typical example of XSS attack) is not possible.
- SessionIPProtectionEnabled = True. Specifies whether the session IP protection is enabled. When this property is set to true, the HTTP session cannot be accessed from different IPs. Only requests from the IP that started the session are processed.
From incident response perspective
To be able to identify the real attack happened because of the XSS vulnerability and also from some other web-based vulnerabilities, it is recommended to configure the following parameters.
- LogCLF = TRUE in configuration file http.properties enables logging in CEF format.
- ArchiveOldLogFiles = ON. The Log Configurator service provides an option for automatic archiving of log files. Logs are written into a set of files. When the last file is completed, the new logs start overwriting the old log files. If there is no archiving for access logs, all logs soon will be overwritten.
- Enable Additional information logging [13].
- HttpTrace= Enable. To enable HTTP Trace for more information run ConfigTool. Open the Properties tab of the HTTP Provider Service running on the dispatcher and assign the appropriate value to the HttpTrace property.
Comments