XSS protection

[octopusinvitro]

See our contributing guides.

Sinatra comes with some protection out of the box, but still there are some extra things we can do:

Input validation:

• At the moment we have basic native validation. Are there any relevant restrictions we can add?

Input sanitization:

• Some kind of tags stripping.

Output Escaping

• We could use the ERB::Util method html_escape (aliased as the shorter h) on the params received from the form before sending them to Stripe/Salesforce/etc.. See: http://ruby-doc.org/stdlib-1.9.3/libdoc/erb/rdoc/ERB/Util.html#method-c-h. Not too sure about this though, it's meant to be used more when spitting data to a view.

Setting up CSP:

• Either setting the HTTP headers in Sinatra or adding a meta tag:

get '/foo' do
    headers['Content-Security-Policy'] = 'script-src none'

<meta http-equiv="Content-Security-Policy" content="script-src none">

Using HttpOnly cookies:

• Are we going to use cookies on this? https://www.owasp.org/index.php/HttpOnly

---

Some useful guides:

• HTML5 Security Cheatsheet
• XSS (Cross Site Scripting) Prevention Cheat Sheet
• XSS Filter Evasion Cheat Sheet
• I’m harvesting credit card numbers and passwords from your site. Here’s how.