SiteLock reports an XSS vulnerability in login page

Tue, 08 Sep 2015 12:49:19 +0000

We've recently signed up for SiteLock on our web server and it's reporting an XSS in the login page:

URL:http://q2a.our-site.com/login?=LogIn&code=0-1441040883-7ad6946dd99e52fbef6d480fb07ff889b9381c19&dologin=Login&emailhandle=1&password=1&remember=1&to=

Cross site scripting vulnerability found in args: ,code,dologin,emailhandle,password,remember,to

Is this a false-positive? I can see that any args sent are reproduced in the 'qa-part-form' but they seem to be correctly escaped and I can't see how to abuse this.

How to know when to escape HTML entities?

Wed, 01 Jun 2011 15:33:01 +0000

I just found that some code I had added to a theme was not escaped and thus open to HTML injection and XSS (although in my particular case it would only affect the hacker, not anyone else). I had this code:

$handle = qa_get_logged_in_handle();
$this->output('etc ' . $handle . ' etc');

I have now added the qa_html function to escape $handle. But how am I supposed to know which content is already escaped, and which is not? I see code like this in Q2A's theme, it's not obvious whether the title has already been escaped:

$headtitle=(strlen($pagetitle) ? ($pagetitle.' - ') : '').$this->content['site_title'];
$this->output('<TITLE>'.$headtitle.'</TITLE>');

Question2Answer Q&A - Recent questions tagged xss

SiteLock reports an XSS vulnerability in login page

How to know when to escape HTML entities?