Cross Site Scripting(XSS) (<a href="http://en.wikipedia.org/wiki/Cross-site_scripting">http://en.wikipedia.org/wiki/Cross-site_scripting</a>) is a security
hole that allows evil-doers to inject code into a web page.

<p><a href="http://www.acunetix.com/cross-site-scripting/scanner.htm">http://www.acunetix.com/cross-site-scripting/scanner.htm</a> - Acunetix Scanner - Free XSS scanner, does not allows saving of reports

<p><a href="http://kallahar.com/smallprojects/php_xss_filter_function.php"><code>http://kallahar.com/smallprojects/php_xss_filter_function.</code></a> - 
<code>RemoveXSS</code> php function that seems to solve
the problem.

<h2>Test Case</h2>
I downloaded the <a href="http://www.acunetix.com/cross-site-scripting/scanner.htm">http://www.acunetix.com/cross-site-scripting/scanner.htm</a> (Acunetix Scanner) and ran it on
<a href="http://chesstst.eecs.berkeley.edu/pubs/search/"><code>http://chesstst.eecs.berkeley.edu/pubs/search/</code></a> and it found plenty of problems.

<p>I tried modifying <code>php/pubs/pubs.php</code> so
that we called the PHP <code>htmlentities()</code> function:
<pre>
$keywords         = htmlentities(getREQUESTValue('keywords'));

</pre>
However, that did not work.
<p>What did work was adding <code>RemoveXSS()</code> to
<code>php/include/utils.inc.php</code> and then modified
<code>pubs.php</code>:
<pre>
$keywords         = RemoveXSS(getREQUESTValue('keywords'));
</pre>

Rerunning the scanner showed no vulnerabilities.


<h2>Problem pages</h2>
Our biggest risks are from users who are not logged in,
so we should concentrate on those pages first.
<p>Any page that has a form (field, checkbox, radio button etc) or any page that processes the URL to do something
is at risk.

<p>Pages that were ok
<ul>
<li><a href="http://chesstst.eecs.berkeley.edu/search/"><code>http://chesstst.eecs.berkeley.edu/search/</code></a>
- found not vulnerable to XSS with Acunetix

<li><a href="http://chesstst.eecs.berkeley.edu/ptolemy/wiki/http://chesstst.eecs.berkeley.edu/ptolemy/wiki/"><code>http://chesstst.eecs.berkeley.edu/ptolemy/wiki/</code> Ptolemy wiki, uses <a href="http://www.pmwiki.org/">PmWiki (<code>http://www.pmwiki.org/</code></a>
- Partially checked with Acunetix, no problems.
</ul>

<p>Offhand, these pages are publicly accessible that
have forms:
<ul>

<li><a href="http://chesstst.eecs.berkeley.edu/pubs/search/"><code>http://chesstst.eecs.berkeley.edu/pubs/search/</code></a> - found vulnerable with Acunetix, fixed with
simple fix above, but what about other things passed
in URLS?
<br>Fixed by having get* functions call RemoveXSS

<li><a href="http://chesstst.eecs.berkeley.edu/people/directory/"><code>http://chesstst.eecs.berkeley.edu/people/directory/</code></a> - found vulnerable with Acunetix
<br>Fixed by having get* functions call RemoveXSS



<li><a href="http://chesstst.eecs.berkeley.edu/bugzilla"><code>http://chess.eecs.berkeley.edu/bugzilla</code></a> 
- partially tested with Acunetix, no vulneratbilities found
thus far

<li><a href="https://trustt.eecs.berkeley.edu:446/wise/apply/"><code>https://trustt.eecs.berkeley.edu:446/wise/apply/</code></a> (SecurIT, Superb and Wise applications, TRUST only)
- found vulnerable with Acunetix
<b>Note that testing generates hundreds of emails</b>
<br>Fixed by having get* functions call RemoveXSS


</ul>

<p>Pages that process URLS:
<ul>
<li><a href="http://chesstst.eecs.berkeley.edu/chess/faq/?displaystyle=flat"><code>http://chesstst.eecs.berkeley.edu/chess/faq/?displaystyle=flat</code></a> - found vulnerable with Acnetix
<br>Fixed by having get* functions call RemoveXSS
</ul>

<h2>Java Server Pages (JSP) are now fixed</h2>
<ul>
<li><a href="http://chesstst.eecs.berkeley.edu/chessj/gsrcCalendar.do?calendarName=chessCalendar&gsrc.location.group=chess">CHESS Calendar</a> (JSP)
- found vulnerable with Acunetix
<br>Fixed by Allen

<li><a href="https://chesstst.eecs.berkeley.edu:444/chessj/resetpassword.jsp"><code>https://chesstst.eecs.berkeley.edu:444/chessj/resetpassword.jsp</code></a>  Changing password (JSP)
- found vulnerable with Acunetix
<br>Fixed by Allen

</ul>
<h2>Possible Solutions</h2>

One idea would be to change getREQUESTValue() so that
it uses RemoveXSS().  This would cause problems with
any pages where we allow html tags such as
<ul>
<li>faqs and forums
<li>applications?
</ul>