A client I have built an Expresso-store site for has just had a pretty comprehensive Penetration Test performed on it. One of the areas they highlighted, and the client wants to be addressed, is the limited sanitisation performed on checkout process fields.
Here is the actual report entry:
Whilst testing, 2-sec attempted to see it was possible to generate cross-site scripting errors within the application using the HTML tag in certain input fields. From this, it was found that the application sanitised certain inputs, which could be attributed to input blacklisting. 2-sec identified that whilst the tag was sanitised it allowed other HTML tags to be used. Below are a list of tags allowed by the application:
<a> <h1> <p> <table>
When entered into a form field the application rendered these tags as html, so for example when the tag was input then the name of the user could be converted into a link on their billing name during the checkout process. Although these tags are usually considered harmless, it does identify that limited sanitisation is carried out by the application.
Could you suggest the best way of achieving this without modifying the core code from the Store module?