Kentio 13 Form Input Validation for security

Francis Carroll asked on April 26, 2023 09:44

Hey,

I have a couple of sites in kentico 13 that all have default kentico forms.

Recently we done an audit and relised that kentico default forms dont have any prevention for users entering certain characters that would be used for scripting etc.

Is there any way to apply validation to prevent certain characters from being entered gloabally on all the forms? (ie >, <, & etc)

If the only solution is to add validation to each form input, is this regular expression enough, ^[^<>|^&=%$]*$?

Recent Answers


Juraj Ondrus answered on April 26, 2023 13:33

If you aren't using any custom form components, then the default ones are sanitized - so even if somebody will submit a text with e.g. some JS command, it will be just text, it will not be executed. Or, do you have any proof of concept?
One idea would be adding e.g. a custom Javascript code to the page to do the client side validation. Or, to do a server side validation, you can use the bizformitem event handler and e.g. in the before insert event check the submitted data, parse them and decide whether you want to save them or not.

0 votesVote for this answer Mark as a Correct answer

Francis Carroll answered on April 26, 2023 15:58

Thanks Juraj for the hasty reply,

We in fact are not using any custom form components, so from a security point of view is there any need to worry about what might be entered by a user, from either client or server side if these fields are being sanitised?

Is there any recommendations on this?

0 votesVote for this answer Mark as a Correct answer

Juraj Ondrus answered on April 27, 2023 07:10

At this moment we are not aware of any security issues. And our security team is checking these things regularly and especially things like user inputs are checked multiple times. Any user input, especially from the live site is being sanitized. Unless you have some new technique we are not aware of such an attack yet.

0 votesVote for this answer Mark as a Correct answer

   Please, sign in to be able to submit a new answer.