On 7 Jan 2005, Alfred Hitchcock wrote:
> Hi All, I have a major doubt it would be of great help if anybody can
> provide solution to this. I have a web page which allows to upload files
> such as jpeg and html files. Is there any mechanisms which can detect
> malicious html files. E.g. if a html page has got a malicious java
> script such as alert('xss') then how can we check these things. One more
> point to be noted here is that uploading of file can be done by any
> user.
Aside from the standard response of 'do not allow uploading of HTML files'
to prevent possible malicious code execution, another option is to
disallow any server side script parsing like PHP and CGI. The second
option should limit the code to client side parsing only, which brings us
back to the topic of malicious Javascript execution (or other such client
side code).
One possible programmatic option is to run a regex filter against the file
that is uploaded to strip out or hide the javascript code before it is
saved to your filesystem.
If there is a more interesting solution to this I would love to learn
about it. I personally do not allow such files to be uploaded.
--
Regards,
Paul Laudanski - Computer Cops, LLC. CEO & Founder
CastleCops(SM) - http://castlecops.com
Promoting education and health in online security and privacy.
Received on Jan 09 2005
Intro
