How to protect from injection attacks when using KnockoutJS?

10
votes

Our company was planning to use Knockoutjs but I found this link discussing security issues in KnockoutJS. They are saying that people can easily inject malicious code in data-bind attribute.

For example:

<script src="http://knockoutjs.com/downloads/knockout-2.3.0.js"></script>
<div data-bind="x:alert(1)" />
<script> 
    ko.applyBindings();
</script>

I do not have very good understanding about XSS attacks, and I do not know how many ways people can inject malicious code in web site.

  1. Can anyone tell me when a page is rendered on a client PC, then how people can inject this <div data-bind="x:alert(1)" /> just to get it work? Can anyone tell me how hackers can inject this in a page opened in browser?

  2. Can anyone tell me what other security issues there are for knockoutjs?

If it is not very safe then I will not use it.

I also got links discussing a bit about how to better secure knockoutjs:

Is anyone aware how to get fully secured knockoutjs? Because I have seen the tutorial for KnockoutJS and felt the learning curve is not high.

1
knockout.jsxss
is there any list of tools exist which will check web site url by url to check the threat and vulnerability and at last show result in details with each url and security issue. let me know. thanks - Mou
I have only had time for a cursory study of the site you linked to and the Slideshare presentation, but from what I understand, their criticism is that if an attacker manages to insert for example data-bind attributes of her choosing, Knockout and other JSMVC frameworks offer a broader than necessary attack surface. It does not specify how the attacker is to inject the code in the first place, or that using Knockout enables that somehow. The golden rule, valid here as everywhere: do not trust user supplied data. E.g.: never blindly put stuff you got from a user into a html binding. - janfoeh
The Open Web Application Security Project is a good place to familiarize yourself with XSS and other threats. - janfoeh
From the quick look I had at the site I couldn't really determine how someone would modify the value in a data-bind attribute. I know knockout will encode when using the text binding so it's recommended to use the text and be very careful when using the html as it allows for xss so only use it if you trust the html being output - Wayne Ellery
@IanGrainger yes the answer is no because it is just using JavaScript to set the value element.value=viewModel.value - Wayne Ellery

1 Answers

7
votes

"Securing knockout" is not how you prevent XSS.

You have to manage your XSS exposure in the first place regardless of how you are binding data to elements in your application and that starts with securing your page that has the knockout binding in the first place:

  • Validate input that would impact the return of that specific web page List item

  • Don't allow users to render html output provided by users without sanitizing it first

  • Don't allow untrusted 3rd parties to deliver script references or incorporate links from 3rd parties you don't trust.

Full list of how to prevent XSS is here:

https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet

https://www.owasp.org/index.php/DOM_based_XSS_Prevention_Cheat_Sheet

You will notice that "not using knockout" is not on either of these lists and that most of the issues are related to managing user input and how it ends up in your script code. The same would be true of how user input ends up in your knockout binding.

Managing your knockout exposure by using the secure binding mechanism you linked above will reduce your potential surface area of attack.

But once you have a malicious piece of html returned by your server or linked in your page regardless whether you have knockout or not you have an XSS problem.