xss filter avoidance

[tablatronix]

When using the code editors I typically experience xss filters that prevent me from submitting. These are either browser reflected xss filters or apache mod_sec.

Avoiding these can be done via ajax submission, but even better would be to encode our form data when submitting to the server.

[tablatronix]

Some workarounds are to disable mod_sec for some stuff. Which is risky, we do use a nonce so that helps a little.

if your host allows it via .htaccess

# disables mod_sec for specific ip and post only
SetEnvIf Remote_Addr ^xxx\.xxx\.xxx\.xxx$ MODSEC_ENABLE=Off
SetEnvIf Request_Method !^POST$ MODSEC_ENABLE=On

You can also disable specific mod_sec rules if you can identify them, or specify specific pages and forms.

[tablatronix]

Did a quick and dirty test encoder that can be done with a plugin via hooks.
Obviously needs testing and has no base64 fallback for browsers that do not support btoa
no clue what the char support is for unicode etc. but you get the gist, could always do some serializing or a custom encoder $val.serialize() etc.

// common hook
if (get_filename_id() == 'components' && isset($_POST['submitted'])){
    if(isset($_POST['encoded'])){
        foreach($_POST['val'] as $key=>&$val){
            $val = base64_decode($val);
            // print_r("DECODING DATA for $key \n");
            // print_r($val);
        }
        unset($val);
    }

    // echo "<pre>";
        // var_dump($_POST);
    // echo "</pre>";
    // die();
}   

// use php or js to target which pages, depending on which hooks and where you output 
// <?php if (get_filename_id() == 'components'){ /?>
<script>
$( document ).ready(function(){
    $("#components form.manyinputs").submit(function(e){
        e.preventDefault();
        var form = this;
        $(form).find($("textarea[name='val[]']")).each(function(e){
            $newval = btoa($(this).val());
            // console.log($newval);
            $(this).val($newval);
        });
        $("form.manyinputs").append($("<input name=encoded value=true>"));
        form.submit(); // submit bypassing the jQuery bound event
    });
});
</script>
// <?php } ?>