Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

In order to prevent Cross-site scripting (XSS) in a private web application that supports image upload, I intend to reject browsers that are vulnerable to content sniffing.

Which browsers are currently vulnerable to this exploit?

PS. I'm aware of the X-Content-Type-Options header, which isn't fully supported as far as I know.

share|improve this question

1 Answer 1

up vote 1 down vote accepted

If you don't send a content-type header most browsers will do content sniffing. If you do send a content-type header as far as I know all versions of internet explorer will do sniffing unless x-content-type-options: nosniff is set. IE should accept this header starting with IE8 (blogs.msdn.com/b/ie/archive/2008/09/02/ie8-security-part-vi-beta-2-update.aspx).

Just an idea: you might try to detect if the browser is vulnerable to content-type sniffing by serving an HTML page with an redirect as content-type: text/plain. If you the browser gets redirected it is vulnerable (you might also check the effectiveness of the nosniff option this way). If you just include this test-page into a small and maybe invisible iframe you can do the check without affecting the rest of the website.

share|improve this answer
    
Hmm capability testing is a nice approach, I think it would work with single page js applications, so I could check whether the browser is vulnerable to content sniffing and prevent the inclusion of images if necessary... I will combine this with a server side image resizer, that should do the trick. –  inf3rno May 9 at 14:26

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.