I'm trying to test a malicious link through the browser and I need to check CF logs to see how it has been dealt with - Can anyone know which CF log I need to go into and check this? Cross Site scripting is on but when i do a global search for the malicious url I don't see the request logged anywhere. How can I tell if I cant see it in logs if Cross Site Scripting enabled has worked ??

@saghosh where are the docs for the "Enable Global Script Protection" CFAdmin setting? I've asked Google and the search within the CF docs and... other than third-party stuff, nothing that actually documents how it works. Or... even mentions it. The setting for

<cfapplication>

(sic) is mentioned, but not the admin setting; and nothing really explaining how it works..?

Let me check, Adam, and get back to you tomorrow.

@Mauro caresimo when you use the bad link, what response do you get?

the only think I can find is this in Fusionreactor @Adam Cameron

I mean literally on the browser. What did you see?

oh it just redircts to our website login page thats it

And the redirect to the login is because.... you're not logged in? So the server is not servicing the request with the malicious stuff in it anyhow? I suspect all CF will be doing with the XSS-vuln-code will be to replace

<script>

with

<invalidtag>

(or similar handling for other vectors). From reading the docs for

<cfapplication>

(https://helpx.adobe.com/uk/coldfusion/cfml-reference/coldfusion-tags/tags-a-b/cfapplication.html), it's talking about protecting scopes, so - reading between the lines - it doesn't stop the requests (so doubt it'll log anything), it just tries to sanitise dodgy stuff. I think the FR thing you are seeing is just HTTP/HTTPS, and not to do with this? I doubt CF would do anything as "sophisticated" as raise a flag or log anything when it does this replacement. However I would start with a more simple case... send an XSS-ridden request to URL that will actually process the XSS-ridden content, and see what you get with the setting on & off. Also... IMO you should not leave dealing with this sort of thing to the CF server. Dealing with XSS and other vulns is complicated and not really CF's job, and I doubt the CF Team have more than superficial experience with dealing with this stuff. It should be handled by your WAF, cos... that's its job.

XSS should also be handled in your code, always safefy encode on output

Oh yeah, sorry, I didn't mean "don't prepare yer output appropriate to the expected consumption mechanism". But that's just as a matter of course.

😂 I thought it would be safe to trust a CF legend🤣 @Adam Cameron ! Cheers both much appreciated 🙏🙏

Re the logging... if you perform the simpler experiment I mention above, it should be easy enough to check the logs immediately after the req for updates. No updates => no, CF doesn't log anything. I think it would be handy if it did though!

by the way what is WAF ? 😀 Do you mean platform team or devops ?