How to prevent XSS when transferring web page content within XML

Question

I have an ASP.NET web application which uses HTTPS and XML based request-response. It seems a user's session cookie can be retrieved via XSS, if the request/response is intercepted and malicious JavaScript code is added as a payload.

Since it is an XML based request-response, the payload has to be HTML encoded. Here is an example:

"<iframe name="if(0){\u0061lert(1)}else{\u0061lert(document.cookie)}" onload="eval(name)"/> 

Is there any way I can stop executing any malicious script?

1. How to identify a request/response containing a malicious script? I noticed that all malicious scripts must contain ", &, ( and ), but user data may also contain these characters.
2. How do I stop such a script to be run on users' browsers? I have already tried decoding all request/ response to corrupt the script which works, but my requests/responses contain user data which contains characters like &. This leads to the whole XML to become corrupt, which crashes the application.

Answer 1

You are on the right track, with XML encoding. You can't predict all possible malicious content, so encoding dynamic data to guarantee it is benign is the right approach. The issue you've run into is that things get really wonky if you try to handle output encoding for multiple output locations all at once. The right approach (and you're close) is to encode for the current output location only, and let other output locations encode for themselves.

I think the thing that is confusing you is that you are thinking of the XML as though it is the raw output to the HTML. You need to consider the XML as part of your network communications protocol stack, and the HTML as separate output.

If I read this correctly, you have some server code that writes an XML message, and some client code that runs in the web browser, receives the XML message and writes to HTML, JavaScript, URL or CSS context. (If I read incorrectly, then you probably have a back end writing XML to a front end that is writing HTML, JavaScript, URLs and CSS. In this case, just consider the front end to be the client of the back end in the rest of this post.)

Therefore, the server is responsible for safely writing XML and the client is responsible for correctly writing HTML, JavaScript, URL and CSS data. This way, the code writing the output is responsible for the safe presentation of that output.