This is my situation: a user uploads a pdf file to my server. The data travels encoded in base64 (like a regular input in a form). The base64 is saved in one particular file on my server. Now, another user wants to access that pdf, so he calls an specific endpoint of my server that returs the base64 encoded pdf string (in a json, among other data).

Now, to show the pdf, i am using the html object tag, like this:

<object id="byte_content" data="" type="application/pdf" width="100%" height="450px"></object>
document.getElementById('byte_content').data = 'data:application/pdf;base64,'+json.base64pdf;

Finally, these are my questions:

  • At server side, if I don't ever open/execute the file that contains the base64 string, I am protected from any kind of attack, right?
  • At client side, does the object tag execute the embed content in a sandbox enviroment? For example, can an attacker put some javascript code in the pdf that steals the cookies or some other XSS attack?

If you need any more specific info, please tell. Sorry for my bad english, and thanks in advance.

  • 1
    1. does your server base64 encode before storing? if not, see sqli, path traversal, and DOS. 2. <object> is long obsolete, use an <iframe>, preferably with a parent CSP (just in case) to protect against your mentioned vectors. – dandavis May 16 '18 at 20:58
  • 1
    I can't validate the pdf at server side (because of my backend technology). Because of that, the server only take the string from the input value and store in a particular file with a hardcoded name (no sql inyection, no path traversal). The thing is: at client side i want to rely in the browser pdf viewer, that takes some data (a valid pdf, a malicious pdf, or something that is not a pdf) and tries to show it without producing any harm to my user ¿can i trust in Chrome or Firefox pdf viewer? – Nicholas May 17 '18 at 10:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.