Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

If I am taking data from a website, for example status updates from Facebook and showing them on my website. What possible damage can be caused if I am not taking into account that the code written as status update would execute on my website?

For example, Mr. Simon has putted his status update,

"<p style="color:red;">I love to code</p>"

Now, when I display this on my website, it transforms into the text I love to code written in red.

share|improve this question
2  
Is you question just "What damage can an xss vulnerability cause?"? –  CodesInChaos Mar 2 '13 at 11:12
add comment

1 Answer

Basically you will be vulnerable to XSS - the element might as well be a script element or the paragraph element could have an onmouseover etc attributes to run a script.

  • If you are not using HttpOnly session cookies, XSS can be used to steal sessions.
  • All security measures against CSRF are useless if you are vulnerable to XSS.
  • The script can dynamically load malicious java, flash, pdf etc plugin files, which can exploit bugs in the respective browser plugins.
  • The script can redirect the user somewhere else, hide your page or make for a convincing phishing page since it's on your domain.
  • Probably many more - only your imagination is the limit :)
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.