1

I was experimenting with some Anti-XSS solutions, and during my research, I found following the XSS vector in a cheatsheet:

<EMBED SRC="data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==" type="image/svg+xml" AllowScriptAccess="always"></EMBED>

Since the SVG is not loaded as picture, but instead as "embed", its JavaScript content is executed.

I have two questions:

1) Is there a way to disable JavaScript? If I replace "always" with "never", it still executes the JavaScript.

2) I would like to give trusted users the ability to include HTML content to an internal website. I want to give them a lot of freedom, like adding pictures, inserting YouTube videos, maybe even Google Maps iframes and stuff, as long as they don't execute JavaScript. But if I would give them access to the HTML "embed" tags, do I need to worry about JavaScripts/XSS execution?

1

I believe, the attribute AllowScriptAccess only works in context of Flash-Objects, as referenced here. It does not appear to be part of the embed-tag definition, as these links suggest.

Therefore my answer would be:

  1. No. Not in an embed-tag.
  2. Yes. I would disallow the embed-tag to secure your application.

As suggested in this answer you could also consider to use a different domain for the user content and let the same origin policy aid you.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.