script injection through URL: how to resolve?

[khalidMomin]

I am facing an issue with an hacker, who is injecting scripts through URL. For ex:

localhost:4502/content/mypage/homepage.html?<script>alert("XSS");</script>

this is showing an alert with "XSS".

I want to disable all the special character. I tried adding filter in dispatcher, modifying .htaccess of my webserver and writing java-script handler, but none worked for me.

I am using some query parameters in my application, so cant block all query params.

Please help to stop this script injection.

[jantzen_b]

Hi Khalid,

I was able to find a pretty good article on XSS attacks here. This is an external site, so please take any recommendations it makes as general advice as it is not Adobe certified content. Hopefully, some other community members can share some of their tactics for preventing these sort of attacks.

Best of luck,

Jantzen

[kautuk_sahni]

I am not able to reproduce this behavior.

Have you implemented some custom code for handling query parameters?

If you are capturing some Query parameters, then i would suggest you to parse them and remove special characters.

like:- query= query.replace(/</g, "&lt;").replace(/>/g, "&gt;");

Or 

function( query) {
    return $( $.parseHTML(query) ).text();
}

If you explain your use-case and implementation we could help you more.

~kautuk 

[Feike_Visser1]

For every implementation make sure all the output is escaped in the correct way.

Here a sheet with XSS examples: 

https://docs.adobe.com/docs/en/cq/5-6-1/developing/securitychecklist/_jcr_content/par/download/file....