Bypassing Cross-Site Scripting Using A Proxy

by Jon 12/13/2007 9:46:00 AM

When I implemented Sprinkle, which is a client-side includes (CSI) system I came up with that doesn't use IFRAMEs, I kept running into the scenario where you may want to fetch HTML from an external web site besides your own. This is sort of what Web 2.0 is all about, being able to mashup the world with not just your crap but everyone else's crap as well.

I threw together a trivial solution. This is ASP.NET-only, I might come up with a PHP-based equivalent. The idea is to implement a really trivial proxy server and cache the data for a period of time. In this particular implementation, I cache it directly into the web Application's in-memory collection.

Here's what using it might look like ..

        <%-- Client-side includes with server-side cross-site proxying --%>
        <script type="text/javascript" src="
http://sprinklejs.com/sprinkle.js"></script>
        <div src="proxy.aspx?url=http://www.sprinklejs.com/info.html" />
       
        <%-- Server-side includes with cross-site proxying--%>
        <ssi:ProxyControl runat="server" ID="GoogleInsertion"
            SourceUrl="
http://www.google.com/"
            DetectImposeBase="true"
            BaseUrl="proxy.aspx?url=http://www.google.com/" />

In the server-side include implementation, the DetectImposeBase and BaseUrl properties are really just hacks where I force-inject the proxy URL to any src and href element attributes.

If you try to use the above-referenced proxy.aspx file from an external web site, it should fail. The referer header can only be on the same host.

If you try to reference a very large binary file or something, it will fail. Maximum file size is enforced, so as to not overload the Application in-memory collection that hosts the proxy cache.

This implementation doesn't work flawlessly and it's sort of a prototype thing, it only took about an hour to hack together (plus some time I spent struggling with Visual Studio puking on me), but anyway, here it is.

Download: http://sprinklejs.com/SSI_Proxy_ASPNET.7z

kick it on DotNetKicks.com

Related posts

Add comment


(Will show your Gravatar icon)  

  Country flag





Live preview

10/7/2008 9:28:12 PM


 

Powered by BlogEngine.NET 1.2.0.0
Theme by Mads Kristensen

About the author

Jon Davis Jon Davis (aka "stimpy77") is a software and web developer by day and a software and web enthusiast (geek) by night. He was recently a senior web engineer for the enthusiast division of a major magazine publishing company for nearly two years. He has been a programmer, developer, and consultant for web and Windows software solutions professionally since 1997, with experience ranging from OS and hardware support to DHTML programming to IIS/ASP web apps to Java network programming to Visual Basic applications to C# desktop apps.
 
Software in all forms is also his sole hobby, whether playing PC games or tinkering with programming them. "I was playing Defender on the Commodore 64," he reminisces, "when I decided at the age of 12 or so that I want to be a computer programmer when I grow up."
 
Jon is currently engaged in a short-term ASP.NET contract and is available for hire for short-term or permanent work in Phoenix or via telecommute.
E-mail me Send mail

Calendar

<<  October 2008  >>
MoTuWeThFrSaSu
293012345
6789101112
13141516171819
20212223242526
272829303112
3456789

View posts in large calendar

Pages

    Recent comments

    Authors

    Tags

    Disclaimer

    The opinions expressed herein are my own personal opinions and do not represent my employer's view in anyway.

    © Copyright 2008

    Sign in