1

I have a website on which users can select a file from their local machine, manipulate it and then save it.

The website is written entirely in JavaScript to ensure it's purely client-side. Is the content of the file that the user selects completely secure (from the perspective of the website itself, I realise the user could have malicious code on their local machine, etc.)?

5
  • 2
    What do you mean by "is the file secure"? Secure from what? What is the threat? – MechMK1 Sep 19 '19 at 9:13
  • Sorry, security is not my strong point. Secure in the general sense that a MITM (or similar) attack couldn't successfully get the data from the file the user uploaded on the client-side. Effectively I'm trying to figure out whether it's at all possible that the users' file data could be stolen through the website (ignoring any malicious code they may already have on their device) – Dell Sep 19 '19 at 9:16
  • If the entire application runs on the client's browser, then there is no "upload" anywhere anyways. – MechMK1 Sep 19 '19 at 9:28
  • 1
    Is the website itself considered a potential threat (ie, what if you get hacked)? – AndrolGenhald Sep 19 '19 at 9:31
  • No the website isn't to be considered a threat. – Dell Sep 19 '19 at 9:36
1

Secure in the general sense that a MITM (or similar) attack couldn't successfully get the data from the file the user uploaded on the client-side

MitM is not possible in such a scenario as the file never leaves the client so the attacker cant intercept it. However, an attacker with Man-in-the-Middle capabilities could still intercept your JavaScript code in transmission, so it is highly recommended to use HTTPS everywhere.

The website is written entirely in JavaScript to ensure it's purely client-side

Well if there is no server side processing you have greatly reduced the attack surface.There is also no user base(cookies,jwt) i assume so an attacker cant target that either.The only thing i can think of is cross site scripting.An attacker could inject malicious javascript and then wait for the user to upload something,when the victim does he can simply retrieve that file.

Also i might add from androl's comment that you could also be "hacked" via vulnerability you introduce by using any piece of program that is vulnerable.But i wont comment on that.Always be updated and informed to prevent from such

2
  • 1
    I added some more infos as to why HTTPS is useful. Feel free to roll back if you disagree with the addition. – MechMK1 Sep 19 '19 at 9:45
  • @MechMK1 no you are correct.I missed that point – yeah_well Sep 19 '19 at 9:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.