4

In order to prevent Cross-site scripting (XSS) in a private web application that supports image upload, I intend to reject browsers that are vulnerable to content sniffing.

Which browsers are currently vulnerable to this exploit?

PS. I'm aware of the X-Content-Type-Options header, which isn't fully supported as far as I know.

4

If you don't send a content-type header most browsers will do content sniffing. If you do send a content-type header as far as I know all versions of internet explorer will do sniffing unless x-content-type-options: nosniff is set. IE should accept this header starting with IE8 (blogs.msdn.com/b/ie/archive/2008/09/02/ie8-security-part-vi-beta-2-update.aspx).

Just an idea: you might try to detect if the browser is vulnerable to content-type sniffing by serving an HTML page with an redirect as content-type: text/plain. If you the browser gets redirected it is vulnerable (you might also check the effectiveness of the nosniff option this way). If you just include this test-page into a small and maybe invisible iframe you can do the check without affecting the rest of the website.

  • Hmm capability testing is a nice approach, I think it would work with single page js applications, so I could check whether the browser is vulnerable to content sniffing and prevent the inclusion of images if necessary... I will combine this with a server side image resizer, that should do the trick. – inf3rno May 9 '14 at 14:26
  • @Staffen Ullrich: How to test browser is vulnerable with simple HTML page? I didn't quiet get that. Can you post an example please? – ParagJ Aug 1 '17 at 11:06
  • @ParagJ: <html><head><meta http-equiv="refresh" content="5; url=http://example.com/vulnerable.html"></head></html>. Serve without content-type. Only if the browser interprets this as HTML it will issue the redirect. – Steffen Ullrich Aug 1 '17 at 15:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.