Hacker News Reader

Comment by whizzter | Hacker News Reader

Maybe you can answer one thing that pickled my mind, no mention of CSRF protections,etc in the documentation that seems to cover quite a few bases. (apart from one xss symbol application that I couldn't fully decipher).

View on HN

XSS should not be a problem with many Scheme dialects and Lisps, unless you render JS from user input. This is because SXML does not treat HTML as a mere string, but as structured data (as any sane library should, but very few do). So if you get some user input and want to display that in some label or paragraph or whatever, then SXML is aware what is a tag and what is text content of the tag, due to how you build the SXML expression. This is not PHP or something.

I do not know, whether GNU Artanis makes use of SXML all the way, but I think it is very likely, since SXML is in GNU Guile's standard library.

Even if it is structured data, it's ultimately passed to the browser as a string. If I put text in between two tags, and that text came from user input, how is it going to solve that? Does it autoencode as html entity tags anything coming out in a text node?

While working on the HTML document in your program, you have it always represented as a tree of nodes, a nested list often. When you want to insert user input, that user input is available as a string (unless you first turn it into something else). When you put a string into that nested list, and then at the very end, when you form the response, ask SXML to turn your tree into the HTML string, SXML will error, because it wouldn't know how to handle the string.

(All the other nodes are symbols with potentially subtrees in them, which are also symbols with potentially more subtress in them.)

If you put your user input into one such node as a value of that node, lets say a paragraph tag <p>, then SXML sees the user input as it is, a string. It will make sure, that when it turns the tree into HTML, that string remains merely a string, by escaping things, so that for example when your string is <evil-tag-with attrs="bla"> this is exactly what will be seen as text inside your paragraph text, and not be interpreted.

Basically, SXML will render it like: "Oh, you want some string to be inside your p tag? Sure, can do ... This is what you wanted to be displayed to the user ... You didn't want to run that, did you? Nahh, because then you wouldn't have passed it in the SXML as text content of a p tag."

So I think the answer to your question is "Yes.".

Ah okay - so it uses some special type to represent html-encoded text, which is then valid to shove inside a text element? That sounds quite nice.

I don't think it uses some special type in any way. Rather, if you use sxml to build html in scheme and have a node in there that is a string, then the natural way to serialize this sxml into html will be to safely quote the string. Afterall, if you wanted html tags to be preserved and interpreted in the output, you would first parse the string into sxml and put that into your document. This is the difference between working with structured data vs. plain string interpolation.

But of course this only applies when you use sxml. Artanis apparently can also use plain strings or templates as responses, in which case you will have to take care of safely encoding things too.

SXML is a fairly old thing, but it isn't really typed. [0]

Rather, things are structured, so it's more like a in-memory representation of XML. It doesn't need to be serialised, only deserialised into XML's text syntax. In which case, each piece knows how it needs to be encoded.

           '(h1 (@ (id "greeting")) "Hi, there")

Its just lists of Symbol types, and string or other type values.

[0] https://en.m.wikipedia.org/wiki/SXML

Understood, but if I insert a string into a database that looks like this:

  <script>alert("yoov bin acked")</script>

And that's my username, if it's naively inserted inside some HTML it'll look like HTML to a browser.

So I was wondering if this framework auto-HTML-escapes strings inserted into places where text can go.

You're talking about injection attacks when escaping isn't present.

CSRF is cross site request forgery, f.ex. creating a POST form on a hostile site that targets a POST processing endpoint in on site with data that the user didn't want to supply, but whose login cookie would authorize the request at the target.

Many frameworks inject an per-user "authentication" cookie in form's that is validated upon request, this way an attacker cannot trick the users browser to submit data since they don't have the correct CSRF-cookie.

https://owasp.org/www-community/attacks/csrf

https://developer.mozilla.org/en-US/docs/Web/Security/Attack...

CSRF wasn't really a concern, because we weren't requesting anything from anybody else, and didn't use cookies, etc.

But, specifying your own headers is easy, and we had it in a macro we used for our routes.

So instead, to rip from the manual:

    (response-emit
        body
        #:status 200
        #:headers '(
            (Content-Type . application/json)
            (X-Frame-Options . DENY)
        )
        #:mtime (current-time))

This is an example of clickjacking protection, CSRF is cross site request forgery, f.ex. creating a POST form on a hostile site that targets a POST processing endpoint in on site with data that the user didn't want to supply but whose login cookie would authorize the request at the target.

https://owasp.org/www-community/attacks/csrf

https://developer.mozilla.org/en-US/docs/Web/Security/Attack...

If your problem is in authorisation, then it will be in your business logic, of what a user looks like, what the hierarchy is, and so on. It shouldn't live in your framework.

And the standard ways of doing that, generating single use tokens, will work the way they usually do.

As I said... I didn't use cookies. Which means none of what you listed applied in the first place. Logins were entirely ephemeral and died after a single session ended - as pains were taken to ensure anonymity.

Reply on news.ycombinator.com