Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 2 down vote favorite

I'm building this webapp where users can login and build their own online presentation. To build the presentation they can use their own html, css and javascript. These user files are not uploaded to the server of the webapp (where also the login using php sessions is done on a separate ssl domain) but the files are uploaded to Amazon S3. When a user wants to upload he needs an registered user account before they can start building and uploading. Every user have their own unique domainname on which they build and login.

The html files are being read by php and used in a template engine to build and show the public presentation page (sort of a website). The javascrpt is linked in the html.

Hope you can help me out! I'd like to know if this is a secure setup or are their any risks I need to solve. I've read alot about different security issues and hope this setup solves a lot. Of course a user is self responsible for the public site, but I'm responsible for the central webapp and like to know if they can hack the central system using the uploaded html and javascript

Thanks!

gr. Dennis

share|improve this question

2 Answers

up vote 0 down vote accepted

No, they can't "hack the central system" with HTML/JS (and definitely not CSS). If you gave them PHP access, you'd need to be careful, but normal HTML/JS/CSS is harmless for your server. Not so much for visitors, though. A malicious uploader can do stuff that will harm visitors to the site.

There's one thing that you may need to be careful about in this regard. It really depends upon your setup.

Let's say that the user-provided code is hosted on www.mydomain.com. Let's say that www.mydomain.com also has a login feature on the same server. As a real world example, lets say you own Facebook and are allowing folks to host HTML/JS files to a subdirectory (e.g. www.facebook.com/username/index.html or something similar). Now, if I visit www.facebook.com/eviluser/index.html, his JS has access to my account. Using AJAX, he can wreak havoc with my account. If there are any other websites with Access-Control Allow-Origin for www.facebook.com, and I am logged in on those as well, his JS can wreak havoc (via AJAX) there as well.

Basically, you need to be sure that all AJAX written by the user can do no harm to a visitor. The easiest way to do this is to host it on a domain where there is no "login" functionality whatsoever; so malicious JS has no session to abuse. Or prevent same-origin AJAX (Which probably isn't possible).

Another thing you must be wary of is your users using clickjacking/etc and getting your site blocked.

share|improve this answer
Thanks! The uploaded content will be served from a custom domain, each user uses their own domain from which the presentation is shown to the public. The login happens on a SSL domain and attaches the login session to the unique user domain – Symtex Feb 22 at 8:52
@Symtex: Then it shouldn't be an issue, though the "getting blocked" this is still there. – Manishearth Feb 22 at 8:55
up vote 0 down vote

We can't really give you a guarantee of security as it all depends on what your implementation is down to code-level.

What you always need to make very careful consideration of when accepting and executing code from untrusted sources is, what are the risks if this code is malicious? To help reduce the chances of exploitation of your code, which might come from the user being able to 'escape' out of your templating system and instead execute code as the template parser would be to run the system in a sandbox.

On a typical Linux system this is usually achieved by running in a chroot. You should implement this when parsing your user's uploaded codes.

That deals with lower level exploits, the next issue is are you hosting the generated code? If you are, you have to be aware of things like XSS vulnerabilities. If you are letting users host JavaScript content from a domain which you are accepting logins from, this is an issue because they could easily write a JS function which steals their authentication tokens. Hence they can pretend to be the logged in user on the site and have unrestricted access as them even though they don't have control of the domain. You can read more about this by searching Access Control Allow Origin.

share|improve this answer
Php reads the html page, replace some variables/tags in the html and echo's it. Are there any risks in this? – Symtex Feb 22 at 8:57
Thank you too btw :) – Symtex Feb 22 at 8:59
OK so in terms of risk from exploitation in your templating system, if you're just doing straight text-replacement there is not much of a risk in that, as long as you always know you're replacing with safe values. But consider you might want to provide functionality such as looping in your template system - in that case you're going to be accepting parameters for execution such as your loop start-end limits. This represents an attack surface so make sure these data are properly validated. – deed02392 Feb 22 at 9:00
The looping happens automaticly and isn't controlled by the user in anyway. – Symtex Feb 22 at 9:03
I'm talking about if the user wants to do something like: <% @artists=('Foo','Bar') %><h2>Artists</h2><ul><% foreach @artists $artist %><li><%=$artist%></li><% end %>. – deed02392 Feb 22 at 9:08
show 2 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.