Strip HTML from checkout fields

Question

A client I have built an Expresso-store site for has just had a pretty comprehensive Penetration Test performed on it. One of the areas they highlighted, and the client wants to be addressed, is the limited sanitisation performed on checkout process fields.

Here is the actual report entry:

Whilst testing, 2-sec attempted to see it was possible to generate cross-site scripting errors within the application using the HTML tag in certain input fields. From this, it was found that the application sanitised certain inputs, which could be attributed to input blacklisting. 2-sec identified that whilst the tag was sanitised it allowed other HTML tags to be used. Below are a list of tags allowed by the application:

<a> <h1> <p> <table>

When entered into a form field the application rendered these tags as html, so for example when the tag was input then the name of the user could be converted into a link on their billing name during the checkout process. Although these tags are usually considered harmless, it does identify that limited sanitisation is carried out by the application.

Could you suggest the best way of achieving this without modifying the core code from the Store module?

Thanks

Answer 1

Thanks Peter

As the fields already clean out 'dangerous' tags I just created a small jQuery function to strip out the highlighted tags on submission. It seemed the quickest way to keep the auditors happy with minimal effort!

Answer 2

Without hacking the Store module core code:

Create an extension that sanitises the fields as you want them utilising the Store hooks: https://exp-resso.com/docs/store/extension_hooks.html#store_order_submit_start

Contact Expresso Store providing your findings, as I'm sure they'd be more than willing to incorporate changes in future versions.

Or parse and validate in JavaScript prior to form submission (not ideal as still hackable be someone who is determined).