How can I escape Javascript numbers on JSP files (as forJavaScript() doesn't work for negative numbers)?

[Kacper86]

Hi,

How can I properly escape Javascript numbers on JSP files?

forJavaScript() method is designed to work with strings and breaks negative javascript numbers (by encoding them as \-1). I look at the other methods, but I don't see a suitable one.

Thank you for your help!

[jmanico]

When JS data is escaped with JS Hex Encoding, that escaping should be gone when you extract the data from the JS context. If this is not the case, can you give us an example where this escaping is causing your code harm? Aloha,

…

-- Jim Manico @manicode

On Jul 31, 2017, at 5:55 AM, Kacper86 ***@***.***> wrote: Hi, How can I properly escape Javascript numbers on JSP files? forJavaScript() method is designed to work with strings and breaks negative javascript numbers (by encoding them as \-1). I look at the other methods, but I don't see a suitable one. Thank you for your help! — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub, or mute the thread.

[Kacper86]

Sure, here is an example

JSP file:

<%@ taglib prefix="e" uri="https://www.owasp.org/index.php/OWASP_Java_Encoder_Project" %>

<script type="text/javascript">
	var i = -5; //this will normally be var i = ${variableFromController}
	console.log(${e:forJavaScript(i)}); 
	console.log(${e:forJavaScript(-6)});
</script>

The browser will see the first console.log(${e:forJavaScript(i)}); as console.log(); (literally no argument) while the second console.log(${e:forJavaScript(-6)}); as console.log(\-6); which is a syntax error.

So, both console.log lines seem to produce invalid end result. What should I do in this case?

[jmanico]

First of all be sure to QUOTE all JS variables that come from untrusted data. I will be sure to forward this to the library author, stand by. Also can you try this for me? JSP file: |<%@ taglib prefix="e" uri="https://www.owasp.org/index.php/OWASP_Java_Encoder_Project" %> <script type="text/javascript"> var i = -5; //this will normally be var i = ${variableFromController} *alert ("test: " + (7 + **i));* console.log(${e:forJavaScript(i)}); console.log(${e:forJavaScript(-6)}); </script> | Aloha, Jim

…

On 7/31/17 7:03 AM, Kacper86 wrote: Sure, here is an example JSP file: |<%@ taglib prefix="e" uri="https://www.owasp.org/index.php/OWASP_Java_Encoder_Project" %> <script type="text/javascript"> var i = -5; //this will normally be var i = ${variableFromController} console.log(${e:forJavaScript(i)}); console.log(${e:forJavaScript(-6)}); </script> | The browser will see the first |console.log(${e:forJavaScript(i)});| as |console.log();| (literally no argument) while the second |console.log(${e:forJavaScript(-6)});| as |console.log(\-6);| which is a syntax error. So, both console.log lines seem to produce invalid end result. What should I do in this case? — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#6 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAgcCcaS3cD5bzUShqJEca9A3xiTOJmxks5sTd69gaJpZM4OoV1G>.

-- Jim Manico Manicode Security https://www.manicode.com

[Kacper86]

Hi Jim,

Thank you for your response!

First of all be sure to QUOTE all JS variables that come from untrusted data.
But I don't want to quote integers as they will become strings in that case (and I want numbers).

Also can you try this for me?

The following lines are not a valid javascript:
*alert ("test: " + (7 + **i));*
alert ("test: " + (7 + **i));

So, I assume you meant:
alert ("test: " + (7 + i));
which will of course create an alert with "test: 2" message.

After some thoughts, it might be that might question is silly. I just wanted to use escaping in order to protect Javascript code from XSS which is obviously necessary for strings. However, for numbers, I should probably just just native javascript functions: parseInt() or parseFloat(). They will make sure the input is safe in use in Javascript context.

Thank you for helping me realize that!