How to prevent Cross-Site Scripting on form fields in Coldfusion 2016?

Project using Coldfusion 2016 has a basic keyword search feature. Security scan produced a 'Cross-Site Scripting: Reflected' critical vulnerability. 'Hacker' could potentially inject scripts into the results page (ie: <aUdIo SrC=x OnErRoR=alert(74358)>) via the form field.

Should the form validation happen via javascript on the form page? Or once submitted, strip the input of any special characters like <>, etc? I need to modify the code for it to pass this security scan.

code:

<input type="text" name="keyword" value="search by keyword" onfocus="clearThis(this)" />

results page code:

<cfset input = "#form.keyword#">
<cfset keyword = rereplace(input,"[^A-Za-z0-9-]"," ","all") />

Thanks in advance-
HeatherG

AntiSamy Filter

First, you have to scrub all user input using an AntiSamy filter. CF ships with a default configuration file, but I can't find a reference to which it is. I recommend starting with the antisamy-slashdot.xml file found here.

Load a specific config file in Application.cfc (reference the file from outside of the application's web root folder).

<cfset this.security.antisamypolicy = "antisamy-slashdot.xml">

Now you can use the native CF function getSafeHTML().

<cfset SafeHTML = getSafeHTML(inputHTML, "", true)>

The parameters are

1. The string to clean.
2. A specific config file. An empty string references the default or application-defined file.
3. true throws an error, false returns an empty string.

When I implemented this, I created a simple function to loop through a struct and clean all strings, then added it to my Application.cfc.

<cffunction name="getCleanStructData" access="public" output="false" returntype="void">
    <cfargument name="data" type="struct" required="true" hint="Form struct">
        <cfloop collection="#arguments.data#" item="local.x">
            <cfif isSimpleValue(arguments.data[local.x])>
                <cfset arguments.data[local.x]=trim(getSafeHTML(arguments.data[local.x], "", ))>
            </cfif>
        </cfloop>
</cffunction>

Finally, I added calls to that function in onRequestStart():

<cfset getCleanStructData(form)>
<cfset getCleanStructData(URL)>

Now all user input data is cleaned according to the rules defined in the AntiSamy config file. You should be able to safely process this data as you see fit.

Encoding User Input

To further ensure your output is safe, you have to contextually call one of the ESAPI Encoding Functions when outputting user-generated data.

Old school CF only had htmlEditFormat and JSStringFormat. Since CF 10, there are newer functions like encodeForHTML() and encodeForJavaScript() that can escape the larger set of UTF-8 characters. This will convert strings into the appropriate HTML entities to display on a web page. For example:

#encodeForHTML('<script>')#

will render like this, stopping the linked file from being executed.

<script>

More info and examples here: https://owasp.org/www-community/attacks/xss/

Samy is My Hero

Bonus: If you weren't in dev back when this worm ravaged MySpace, here's how we learned XSS was a thing.