title: Trying to pass pci complience but have a cross-site scripting issue
body: <p>I'm currently trying to pass PCI compliance for one of my client's sites but the testing company are flagging up a vulnerability that I don't understand!</p>
  
  <p>The (site removed) details from the testing company are as follows:</p>
  
  <blockquote>
    <p>The issue here is a cross-site
    scripting vulnerability that is
    commonly associated with e-commerce
    applications. One of the tests
    appended a harmless script in a GET
    request on the end of the your site
    url. It flagged as a cross-site
    scripting vulnerability because this
    same script that was entered by the
    user (our scanner) was returned by the
    server unsanitized in the header. In
    this case, the script was returned in
    the header so our scanner flagged the
    vulnerability.</p>
    
    <p>Here is the test I ran from my
    terminal to duplicate this:</p>
    
    <p>GET
    /?osCsid=%22%3E%3Ciframe%20src=foo%3E%3C/iframe%3E
    HTTP/1.0      Host:(removed)</p>
  </blockquote>
  
  <pre><code>HTTP/1.1 302 Found
  Connection: close
  Date: Tue, 11 Jan 2011 23:33:19 GMT
  Server: Microsoft-IIS/6.0
  X-Powered-By: ASP.NET
  X-AspNet-Version: 2.0.50727
  Location: http://www.(removed).co.uk/index.aspx?osCsid="&gt;&lt;iframe src=foo&gt;&lt;/iframe&gt;
  Set-Cookie: ASP.NET_SessionId=bc3wq445qgovuk45ox5qdh55; path=/; HttpOnly
  Cache-Control: private
  Content-Type: text/html; charset=utf-8
  Content-Length: 203
  
  &lt;html&gt;&lt;head&gt;&lt;title&gt;Object moved&lt;/title&gt;&lt;/head&gt;&lt;body&gt;
  &lt;h2&gt;Object moved to &lt;a href="http://www.(removed).co.uk/index.aspx?osCsid=&amp;quot;&gt;&amp;lt;iframe src=foo&gt;&amp;lt;/iframe&gt;"&gt;here&lt;/a&gt;.&lt;/h2&gt;
  &lt;/body&gt;&lt;/html&gt;
  </code></pre>
  
  <blockquote>
    <p>The solution to this issue is to
    sanitize user input on these types of
    requests, making sure characters that
    could trigger executable scripts are
    not returned on the header or page.</p>
  </blockquote>
  
  <p>Firstly, I can't get the result that the tester did, it only ever returns a 200 header which doesn't include the location, nor will it return the object moved page. Secondly, i'm not sure how (on iis 6) to stop it returning a header with the query string in it! Lastly, why does code in the header matter, surely browsers wouldn't actually execute code from the http header?</p>