IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

Preventing
vulnerability
caused
by
cross-site
scripting
Cross-site
scripting
refers
to
a
technique
used
to
cause
Web
server
vulnerability
by
embedding
malicious
code
into
the
URLs
of
Web
requests.
WebSEAL
provides
certain
built-in
protection
for
this
type
of
vulnerability
and
allows
you
to
further
refine
the
protection
by
configuring
URL
string
filtering.
Note:
The
term
″cross-site
scripting″,
although
accepted
by
the
industry,
does
not
entirely
describe
the
range
of
issues
involving
embedded
malicious
code.
Background
Cross-site
scripting
is
a
specific
type
of
Web
Server
vulnerability
created
when
a
client
URL
request
includes
embedded
malicious
scripting.
For
example
(Javascript):
malicious_code
Other
scripting
tags
that
could
be
used
to
create
vulnerability
include
,
,
and
.
When
a
user
clicks
on
a
link
containing
the
malicious
code
(or
enters
such
a
URL
directly),
the
script
is
executed
when
the
HTML
is
read
by
the
user’s
browser.
For
example,
an
attack
can
occur
when
a
user
clicks
on
a
link
that
contains
the
following
URL:
https:///malicious_code
In
this
example,
the
object
is
not
found
and
WebSEAL
responds
by
returning
a
404
″Page
Not
Found″
HTML
error
page.
This
error
page
happens
to
include
the
URL
containing
the
malicious
Javascript.
The
browser
interprets
the
URL
and
executes
the
script.
Refer
to
the
following
CERT
advisory
for
complete
information
about
the
mechanics
of
cross-site
scripting
and
general
preventative
measures:
http://www.cert.org/advisories/CA-2000-02.html
Configuring
URL
string
filtering
The
problem
of
cross
site
scripting—and
embedded
malicious
code
in
general—is
handled
in
two
ways.
WebSEAL
encodes
angle
brackets
(<
>)
in
re-directed
URLs.
The
encoding
can
help
prevent
normal
interpretation
of
scripts
by
the
browser.
You
can
define
string
patterns
to
be
illegal
by
adding
entries
to
the
[illegal-url-substrings]
stanza
in
the
WebSEAL
configuration
file.
For
example:
[illegal-url-substrings]
substring
=