Enhancing security in IBm WCS
1. Protecting against Cross-site Scripting
(XSS) Attacks
What a Cross Site Scripting vulnerability?
Cross-site Scripting allows an attacker to alter the
behavior of your site in many ways, such as inserting HTML, running JavaScript
or displaying images.
How it occur :
Lets take below line of code :
<li class=”current”>${searchTerm}</li>
If someone were to modify this to something malicious,
similar to the following:
It will produce unwanted result.
To control it :
<li class=”current”><wcf:out
value=”${searchTerm}”/></li>
This code By converting to HTML Entities, the browser will
display the text as entered instead of running it as though it was a script
(HTML, JavaScript, ect.).
Using the above example, the input was encoded into HTML
entities similar to the following:
</div><img
src=http://<servername>/<someimage>.jpg><div>
Although the XSiteScriptingProtection is enabled in
wc-server.xml for the Store by default, it didn't stop this particular case.
The OOTB prohibitedChar rules are defined to stop script tags. Adding all possible HTML tags could impact
both performance and store functionality.
2. Enabling WhiteList data validation
When enabled, WhiteList data validation ensures that when a
URL command or view is run, the parameter values conform to a specified regular
expression. For example, you can configure it so that the storeId must be an
integer. When a WhiteList violation is detected, the request is changed to the
ProhibCharEncodingErrorView view. WhiteList data validation is disabled by
default.
Procedure
1.
Open the WebSphere Commerce configuration file.
2.
Search for the following element outside of the
<Module> element:
<XSiteScriptingProtection
display="false" enabled="true" name="Cross Site
Scripting Protection">
3.
Insert the following sample WhiteList
configuration before the preceding element, and modify it to suit your business
needs:
<WhiteListProtection
enabled="true" name="WhiteListProtection" display="false">
<param name="storeId"
regex="[-]?[0-9]*"/>
<param name="langId"
regex="[-]?[0-9]*"/>
<param name="catalogId"
regex="[-]?[0-9]*"/>
<param name="categoryId"
regex="[-]?[0-9]*"/>
<param name="productId"
regex="[-]?[0-9]*"/>
<param name="parent_category_rn"
regex="[-]?[0-9]*"/>
<param name="physicalStoreId"
regex="[-]?[0-9]*"/>
<param name="geoNodeId"
regex="[-]?[0-9]*"/>
</WhiteListProtection>
<XSiteScriptingProtection
display="false" enabled="true" name="Cross Site
Scripting Protection">
Where:
WhiteListProtection.enabled
Global flag to enable or disable WhiteList data validation.
Valid values are true or false.
WhiteListProtection.param.name
The name of the parameter to be validated.
WhiteListProtection.param.regex
The regular expression that defines the allowed values. The
regular expression syntax is based on the standard that is used by Java.
For the regular expression syntax, see the Sun Class Pattern
Java API documentation.
WhiteListProtection.param.maxLength
The maximum number of characters allowed.
4.
In each web module that requires WhiteList data
validation, search for the corresponding Module element. For example, the
Stores web module element:
<Module
contextPath="/webapp/wcs/stores" fileServletEnabled="false"
name="Stores"
urlMappingPath="/servlet"
webAlias="/wcsstore">
<InitParameters adapters="XML/HTTP,
BrowserAdapter" contextSetName="Store"
handleDoubleClick="true"/>
<URLRedirectFilter
enable="true"/>
</Module>
5.
Insert a WhiteListProtection element to enable
this feature for that web module:
<WhiteListProtection enable="true"/>
For instance, to enable WhiteList data validation in the
Stores web module, the WhiteListProtection element is added in the following
snippet in bold:
<Module contextPath="/webapp/wcs/stores"
fileServletEnabled="false" name="Stores"
urlMappingPath="/servlet"
webAlias="/wcsstore">
<InitParameters adapters="XML/HTTP,
BrowserAdapter" contextSetName="Store"
handleDoubleClick="true"/>
<URLRedirectFilter enable="true"/>
<WhiteListProtection
enable="true"/>
</Module>
Note: If the WhiteListProtection element is not specified
for a web module, the default WhiteListProtection value is false (WhiteList
data validation disabled).
6.
Start your WebSphere Commerce instance if it is
not already started.
