Thuiswinkel

Beste,

Ik heb een aanvraag gedaan voor het certificaat van Thuiswinkel.org. Nou heb ik hun feedback terug gehad en mijn website wordt beoordeeld als niet veilig vanwege de onderstaande twee redenen.

Kan iemand mij hierbij helpen?

Reden 1:
Threat
XSS vulnerabilities occur when the Web application echoes user-supplied data in an HTML response sent to the Web browser. For example, a Web application
might include the user’s name as part of a welcome message or display a home address when confirming a shipping destination. If the user-supplied data contain
characters that are interpreted as part of an HTML element instead of literal text, then an attacker can modify the HTML that is received by the victim’s Web browser.
The XSS payload is echoed in HTML document returned by the request. An XSS payload may consist of HTML, JavaScript or other content that will be rendered by
the browser. In order to exploit this vulnerability, a malicious user would need to trick a victim into visiting the URL with the XSS payload.
Impact
XSS exploits pose a significant threat to a Web application, its users and user data. XSS exploits target the users of a Web application rather than the Web
application itself. An exploit can lead to theft of the user’s credentials and personal or financial information. Complex exploits and attack scenarios are possible via
XSS because it enables an attacker to execute dynamic code. Consequently, any capability or feature available to the Web browser (for example HTML, JavaScript,
Flash and Java applets) can be used to as a part of a compromise.
Solution
Filter all data collected from the client including user-supplied content and browser content such as Referrer and User-Agent headers.
Any data collected from the client and displayed in a Web page should be HTML-encoded to ensure the content is rendered as text instead of an HTML element or
JavaScript.

Reden 2:
Threat
XSS vulnerabilities occur when the Web application echoes user-supplied data in an HTML response sent to the Web browser. For example, a Web application
might include the user’s name as part of a welcome message or display a home address when confirming a shipping destination. If the user-supplied data contain
characters that are interpreted as part of an HTML element instead of literal text, then an attacker can modify the HTML that is received by the victim’s Web browser.
The XSS payload is echoed in HTML document returned by the request. An XSS payload may consist of HTML, JavaScript or other content that will be rendered by
the browser. In order to exploit this vulnerability, a malicious user would need to trick a victim into visiting the URL with the XSS payload.
Impact
XSS exploits pose a significant threat to a Web application, its users and user data. XSS exploits target the users of a Web application rather than the Web
application itself. An exploit can lead to theft of the user’s credentials and personal or financial information. Complex exploits and attack scenarios are possible via
XSS because it enables an attacker to execute dynamic code. Consequently, any capability or feature available to the Web browser (for example HTML, JavaScript,
Flash and Java applets) can be used to as a part of a compromise.
Solution
Filter all data collected from the client including user-supplied content and browser content such as Referrer and User-Agent headers.
Any data collected from the client and displayed in a Web page should be HTML-encoded to ensure the content is rendered as text instead of an HTML element or
JavaScript.

De pagina waar ik hulp bij nodig heb: [log in om de link te zien]