Apply contex-aware encoding to the rest of the program.

passman-dev/php/passman/dashboard.php

@@ -99,16 +99,23 @@ $stmt->close();
 
 
 //echo htmlspecialchars($username);
-echo "<h3>Entries of " . $username . "</h3>";
+$safe_username = htmlspecialchars($username, ENT_QUOTES | ENT_SUBSTITUTE, "UTF-8");
+echo "<h3>Entries of " . $safe_username . "</h3>";
 
 if (!empty($result) && $result->num_rows >= 1) {
 	while ($row = $result -> fetch_assoc()) {
+		// Escape output to prevent stored XSS (DB content must be treated as untrusted).
+		$safe_url  = htmlspecialchars($row["web_url"], ENT_QUOTES | ENT_SUBSTITUTE, "UTF-8");
+		$safe_user = htmlspecialchars($row["web_username"], ENT_QUOTES | ENT_SUBSTITUTE, "UTF-8");
+		$safe_pass = htmlspecialchars($row["web_password"], ENT_QUOTES | ENT_SUBSTITUTE, "UTF-8");
+		$webid_safe = (int)$row["webid"];
+
 		echo "<table border=0>";
-		echo	"<tr style='background-color: #f4f4f4;'><td colspan=2>" . $row["web_url"] . "</td></tr>" . 
-				"<tr><td>Username: " . $row["web_username"] . "</td><td>Password: " . $row["web_password"] . "</td></tr>";
+		echo	"<tr style='background-color: #f4f4f4;'><td colspan=2>" . $safe_url . "</td></tr>" . 
+				"<tr><td>Username: " . $safe_user . "</td><td>Password: " . $safe_pass  . "</td></tr>";
 
 		echo	"<tr><td><form method='POST' style='height: 3px'>" . 
-				"<input type='hidden' name='websiteid' value='" . $row["webid"] . "'>" .
+				"<input type='hidden' name='websiteid' value='" . $webid_safe . "'>" .
 				"<button type='submit' name='delete_website'>Delete</button></form></td></tr>";
 
 		echo	"<tr><td colspan=2 style=height: 20px;></td></tr>";

passman-dev/php/passman/notes.php

@@ -83,12 +83,17 @@ $result = $conn->query($sql_query);
 echo "<h3>List of notes/comments</h3>";
 
 if (!empty($result) && $result->num_rows >= 1) {
-	while ($row = $result -> fetch_assoc()) {
-		echo "<div class='note'>";
-		echo	"<div class='note-content'>" . $row["note"] . "</div>";
-		echo	"<div class='note-signature'> by " . $row["username"] . "</div>";
-		echo "</div>";
-	}
+    while ($row = $result -> fetch_assoc()) {
+        // Escape output to prevent stored XSS (DB content must be treated as untrusted).
+        $safe_note = htmlspecialchars($row["note"], ENT_QUOTES | ENT_SUBSTITUTE, "UTF-8");
+        $safe_user = htmlspecialchars($row["username"], ENT_QUOTES | ENT_SUBSTITUTE, "UTF-8");
+
+        echo "<div class='note'>";
+        echo    "<div class='note-content'>" . $safe_note . "</div>";
+        echo    "<div class='note-signature'> by " . $safe_user . "</div>";
+        echo "</div>";
+    }
+
 
 	// Free result set
 	$result -> free_result();

passman-dev/php/passman/xss/stolencookies.txt

@@ -0,0 +1,3 @@
+
+PHPSESSID=2c215dd41fe1090a5da5d0f3adc6ba64
+PHPSESSID=2c215dd41fe1090a5da5d0f3adc6ba64

passman-dev/php/xss/stolencookies.txt

@@ -1,2 +0,0 @@
-PHPSESSID=knjfug3u4gavdas9o4eupe38l1; seclab_user=u1
-seclab_user=u1; PHPSESSID=o1mg400lipd2mck69kpfnl6p5s