Security Issues of the Rank Page

Introduction

The XSS injection problem was discussed before in an XSS hole I left by accident; one situation analyzed there was reusing data transmitted from another page, and the uncontrollability of that data allowed a malicious person to tamper with the data for XSS injection.

How the Rank Page Is Implemented

But what does the rank page have to do with XSS injection?

Here, please note one thing: the ranking results on the rank page come from data in LeanCloud. This site is a static site created by hexo, and the statistics feature of course also relies on LeanCloud.

The main logic of this page is as follows:

var Counter = AV.Object.extend('Counter');
var query = new AV.Query(Counter);
query.addDescending('time');
query.limit(10);  // return at most 10 results

query.find().then((data) => {
    data.forEach((rlt) => {
        // rlt.get('title');  // get the title
        // rlt.get('time');  // get the visit count
    });
});

Security Problems of Using the Return Values Directly

I don’t know whether everyone noticed: we expose LeanCloud‘s App ID and App Key on the front-end page, so anyone can transmit any data.

In this situation, merely storing data is not a problem; the problem lies in reading. If the data read has already been tampered with and we then render it directly onto the page, XSS injection can very likely occur.

Solution — (Add a Filtering Layer)

If you go to the rank page and look at its code, you’ll find this section:

// This map stores all known titles
var m = new Map();

query.find().then((data) => {
    data.forEach((rlt) => {
        // try to get the corresponding title
        let real_blog = m.get(rlt.get('title'));

        // if the title cannot be matched to a known title, skip this entry
        if(!real_blog) {
            console.log("content is corrupted, corrupt content:", rlt);
            return;
        }

        // the visit count also needs to be confirmed as numeric data — it cannot be used directly
        let real_blog_time = parseInt(rlt.get('time'));
        insertPairs(tbl_rank, real_blog['title'], real_blog['url'], real_blog_time);
    });
});

In the code above, an important idea is that data from LeanCloud cannot be trusted; the validity of this layer of data must be verified once, to prevent malicious people from modifying the database.