Question

Prevent Reflected Cross-Site Scripting (XSS) by input validation

1

We want to prevent Reflected Cross-Site Scripting (XSS) by input validation. Does anyone know what the best practice is to implement input validation in Mendix. Keep the following in mind: "• Validate user input and verify it is in the proper length, type and range. • Input validation should be based on a white-list approach (i.e. the application should accept and process only expected input) • Always Implement input validation on the server side. • Always encode untrusted data prior to combining in web pages. The type of encoding should be selected according to the context in which the data is inserted. " Thanks!

asked 2014-01-16

Theo Swart

5 answers

Chris de Gelder · Answer 1 · 2014-01-17

All recent versions of Mendix (from 3 up) are protected against commonly known XSS techniques. You can let security companies perform tests to check.

Jason Braswell · Answer 2 · 2014-01-16

On any input field on a form you can add validation, although it will be client-side validation.

You can do server-side validation of data by adding Validation Rules (see Properties of the entity in the Domain Model). These rules can verify uniqueness, that an attribute falls within a range, or matches a regular expression.

That being said, XSS is used to inject scripts on your browser and html pages, so client-side measures are very helpful as well.

Hopefully, someone from Mendix can respond about any vulnerabilities there might be, or any other best practices.

Michel Weststrate · Answer 3 · 2014-01-17

If you allow users anywhere to enter some form of HTML / richtext data (this holds for the rich text editor as well!) you should always sanitize your input to remove any malicious HTML / javascript code. The community commons module provides some default java actions to do so.

Thijs Schoemaker · Answer 4 · 2014-02-05

According to an answer above, Mendix is protected against commonly known XSS techniques. The XSS Sanitize java action from the CommunityCommons, removes XSS from a string.

For example:, according to https://www.owasp.org/index.php/Cross-siteScripting(XSS) can be seen as XSS, and the XSS Sanitize action cleans this. However, I can store this string without any problems from a Mendix form.

So, do we really need to validate each string attribute on XSS before commit? And what is the Mendix platform exactly providing agains XSS attacks?

Thijs Schoemaker · Answer 5 · 2014-02-05

According to an answer above, Mendix is protected against commonly known XSS techniques. The XSS Sanitize java action from the CommunityCommons, removes XSS from a string. However, I can store a string, containing XSS without any problems using a Mendix form.

So, do we really need to validate each string attribute on XSS before commit? And what is the Mendix platform exactly providing agains XSS attacks?