7

I have been working on providing the security related to the XSS attacks. My website only allows following mime-types:

XML, CSV, HTML, PLAIN, VND_WAP_WML, APPLICATION_ZIP, APPLICATION_PDF, APPLICATION_VND_FDF, APPLICATION_MS_WORD, APPLICATION_OCTET_STREAM, APPLICATION_VND_MS_POWERPOINT, APPLICATION_X_VISIO, IMAGE_GIF, IMAGE_PNG, IMAGE_TIF, APPLICATION_VND_MS_OUTLOOK, APPLICATION_DOWNLOAD, APPLICATION_JSON

I have sanitized HTML files using antiSamy. How can I ensure that the data in the files is safe before uploading the data to database, and prevent persistent XSS attacks?

Improve this question
1
  • Or maybe, "How to ensure that malicious files uploaded by users do not result in an XSS attack when used." ?
    – MrWhite
    Jul 15, 2013 at 11:06

2 Answers 2

Reset to default
7

You can't, really.

You can reduce the chances of content-sniffing running HTML by serving files with a X-Content-Type-Options: nosniff header, and try to avoid them being treated as HTML pages by serving with Content-Disposition: attachment, but still you have older browsers to worry about, and browser plugins. (For example Java's broken SOP and Flash's crossdomain XML sniffing.)

Best workaround if you have to accept user-uploaded files is to serve them from a separate domain, so that any XSS attack can't compromise the main site.

Improve this answer
3
  • but additional domain means extra bucks!
    – Slayer
    Jul 15, 2013 at 11:15
  • 2
    You can use a subdomain but it's not quite as good. It prevents XSS in JavaScript, but it still allows cookie injection from the subdomain into the parent domain. (And if you have a web site running on the bare domain it can read cookies from there too, so you would have to make sure to provide access to the site only through www..) Domain names are so cheap nowadays it's not generally worth it though.
    – bobince
    Jul 15, 2013 at 11:51
  • Agree with you bobince :)
    – Slayer
    Jul 15, 2013 at 11:57
0

you cant.

pdf allows inclusion of otherwise encoded / compressed data, strings can be appended to images etc pp; you'd need to check every file that gets uploaded by a 3rd software (sourcefire build something like such a parser for pdf/zipped - data to extend snort, using lua iirc; but i dont know the state of that project)

Improve this answer
5
  • @(that guy from over there) How can packet sniffing help in preventing xss?
    – Slayer
    Jul 15, 2013 at 10:32
  • packet-sniffing cant help either; it was just an example. what you need is some process that analyses the uploaded data for you with generic parsers for each file-format. the problem is: you can embed different payload in pdf or office-docs that get rendered client-side and is invisible for packet-sniffers. snort was just an example for the use of such a parser.
    – that guy from over there
    Jul 15, 2013 at 11:58
  • In the end, it turns out a tough nut to crack. :(
    – Slayer
    Jul 15, 2013 at 12:15
  • @Prerit: exactamente
    – that guy from over there
    Jul 15, 2013 at 12:27
  • grazie seno`r !! :)
    – Slayer
    Jul 15, 2013 at 13:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .