Contao tl_search table indexes vulnerable url in its database

Haii,

We are in a state of misery where there is a vulnerable attempt to our site which is the reason for my.site.com/?dosearch=true&query=">< script >alert(document.cookie)</ script >, this script get indexed in the tl_search url table and also shown in the search results . Can you please help us to solve this vulnerable cases and also some unidentified arguments containing urls laso get indexed in the field url .For example my.site.com/?foo=bar gets also indexed in our search results, which we are not using in any part of the site.Can anyone show us some way to prevent this , so that the arguments we are using in the site should be only used other aarguments should be popped out from the tables of search and any part of the site.

Which Contao version are you using?

My current contao version is 4.4.8

You should update to 4.4.18 first.

Btw. the only way to prevent this is by using an indexPage hook, where you analyse and process the given URL, removing any query parameters from them, whenever necessary.

Many thanks for the reply. I will update and use hook to avoid this problem.

One doubt ,How can we identify which parameters and arguments are used for our particular site.A s I am new to contao , i have an assumption all the valid arguments should be stored in globals.Is there any kind of that.

Quote:

---

Originally Posted by ebin

One doubt ,How can we identify which parameters and arguments are used for our particular site.A s I am new to contao , i have an assumption all the valid arguments should be stored in globals.Is there any kind of that.

---

This is something you have to analyze for yourself. There might be parameters from your own custom code or from extensions for example.

From the core you might have pagination parameters for example. These depend on the module ID though. It's not a trivial task.

Quote:

---

Originally Posted by Spooky

Btw. the only way to prevent this is by using an indexPage hook, where you analyse and process the given URL, removing any query parameters from them, whenever necessary.

---

I wrote IndexPage hook in my pluggin. When I clicked on rebuild index, my function is not executing. How to process the hook ?

One way to prevent indexing of certain URLs with query parameters is to extend the

PHP Code:

---

$GLOBALS['TL_NOINDEX_KEYS'] 


---

array within app/Resources/contao/config/config.php. E.g.

PHP Code:

---

$GLOBALS['TL_NOINDEX_KEYS'][] = 'dosearch'; 


---

etc.

Quote:

---

Originally Posted by Spooky

One way to prevent indexing of certain URLs with query parameters is to extend the

PHP Code:

---

$GLOBALS['TL_NOINDEX_KEYS'] 


---

array within app/Resources/contao/config/config.php. E.g.

PHP Code:

---

$GLOBALS['TL_NOINDEX_KEYS'][] = 'dosearch'; 


---

etc.

---

like $GLOBALS['TL_NOINDEX_KEYS'][] any other configuration is there for ignoring the url , if theit contains values with specific patterns