Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have been working on providing the security related to the XSS attacks. My website only allows following mime-types:

XML, CSV, HTML, PLAIN, VND_WAP_WML, APPLICATION_ZIP, APPLICATION_PDF, APPLICATION_VND_FDF, APPLICATION_MS_WORD, APPLICATION_OCTET_STREAM, APPLICATION_VND_MS_POWERPOINT, APPLICATION_X_VISIO, IMAGE_GIF, IMAGE_PNG, IMAGE_TIF, APPLICATION_VND_MS_OUTLOOK, APPLICATION_DOWNLOAD, APPLICATION_JSON

I have sanitized HTML files using antiSamy. How can I ensure that the data in the files is safe before uploading the data to database, and prevent persistent XSS attacks?

share|improve this question
    
Or maybe, "How to ensure that malicious files uploaded by users do not result in an XSS attack when used." ? –  w3d Jul 15 '13 at 11:06

2 Answers 2

up vote 5 down vote accepted

You can't, really.

You can reduce the chances of content-sniffing running HTML by serving files with a X-Content-Type-Options: nosniff header, and try to avoid them being treated as HTML pages by serving with Content-Disposition: attachment, but still you have older browsers to worry about, and browser plugins. (For example Java's broken SOP and Flash's crossdomain XML sniffing.)

Best workaround if you have to accept user-uploaded files is to serve them from a separate domain, so that any XSS attack can't compromise the main site.

share|improve this answer
    
but additional domain means extra bucks! –  Prerit Jul 15 '13 at 11:15
2  
You can use a subdomain but it's not quite as good. It prevents XSS in JavaScript, but it still allows cookie injection from the subdomain into the parent domain. (And if you have a web site running on the bare domain it can read cookies from there too, so you would have to make sure to provide access to the site only through www..) Domain names are so cheap nowadays it's not generally worth it though. –  bobince Jul 15 '13 at 11:51
    
Agree with you bobince :) –  Prerit Jul 15 '13 at 11:57

you cant.

pdf allows inclusion of otherwise encoded / compressed data, strings can be appended to images etc pp; you'd need to check every file that gets uploaded by a 3rd software (sourcefire build something like such a parser for pdf/zipped - data to extend snort, using lua iirc; but i dont know the state of that project)

share|improve this answer
    
@(that guy from over there) How can packet sniffing help in preventing xss? –  Prerit Jul 15 '13 at 10:32
    
packet-sniffing cant help either; it was just an example. what you need is some process that analyses the uploaded data for you with generic parsers for each file-format. the problem is: you can embed different payload in pdf or office-docs that get rendered client-side and is invisible for packet-sniffers. snort was just an example for the use of such a parser. –  that guy from over there Jul 15 '13 at 11:58
    
In the end, it turns out a tough nut to crack. :( –  Prerit Jul 15 '13 at 12:15
    
@Prerit: exactamente –  that guy from over there Jul 15 '13 at 12:27
    
grazie seno`r !! :) –  Prerit Jul 15 '13 at 13:45

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.