2

I am not sure, if this question needs to be narrowed down to web applications only, but that is my particular interest.

Suppose a web application receives (retrieves from mailbox) emails, parses the content, stores some information in the database and later it is used to prepare some information on the web page.

Does this open up any additional security risks compared to common input fields like the html textarea field where user can enter strings?

Are there any other security precautions if you know that anyone in the world can send anything and it will be retrieved and parsed by your application?

2

There is no specific problem with email. Processing any kind of external (and thus probably attacker controlled) content has its risk and not only in the server. For example displaying the email within a web application can result in cross-site scripting, CSRF etc, similar to any other content displayed in the browser.

|improve this answer|||||
  • All the answers are nice and calming, but I'm accepting this one because it clearly says "nothing specific with emails" and is the first to do so. – Džuris Dec 16 '15 at 16:58
2

Many web applications already perform this kind of parsing, including on very well-known software. Ticketing systems (for support team), famous booking systems etc., where users receive notifications by email and can directly reply by email to a "mailbox" handled by the web app.

How you parse the email and what you do with its content is the point. Since you plan to parse and output the content of these emails on a web app, two rules apply:

  1. filter on input (and sanitize)
  2. escape on output (to avoid XSS, in particular)
|improve this answer|||||
  • Thanks, I know that this is a common task. It's just that I haven't done it myself yet and wanted to check if there is anything I might overlook by just using a common library :) – Džuris Dec 16 '15 at 16:49
2

The danger with taking data from an untrusted source from a technical perspective (as opposed to issues like receiving illegal content) comes from the possibility of treating that data as an instruction. There are two ways (without human intervention) that can happen: you system is designed to do that or there is a flaw in your processing that causes the data to be treated as instructions. The former might exist in your parsing. For example, if you search for image URLs and follow the link. An example of the latter might be something like a buffer overrun if you receive a large amount of data or an SQL injection.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.