FUDforum: comp.lang.php » Security risks allowing users to upload a css file?

Home » Imported messages » comp.lang.php » Security risks allowing users to upload a css file?

Show: Today's Messages :: Polls :: Message Navigator

Re: Security risks allowing users to upload a css file? [message #181404 is a reply to message #181389]

Wed, 15 May 2013 12:44

Denis McMahon
Messages: 634
Registered: September 2010

Karma:

Senior Member

On Tue, 14 May 2013 20:07:29 -0700, Bhushan N.N wrote:

> Are there any security risks involved in allowing a user to upload a css
> file?
>
> I will be using the uploaded css file for a preview. Using another HTML
> template I already have on the server.

Yes, css can be used to redirect links to, or load images (or almost
anything else) from third party sites.

It's also possible to obfuscate urls in css files using hexadecimal %xx
codes so that searching for common strings won't find them.

I would be vary wary about allowing third parties to upload their own
unchecked css files to use with my website. I certainly wouldn't allow
such css to subsequently be served from my server without at least a regex
check to look for embedded urls and obfuscated url strings, and probably
a manual inspection as well.

--
Denis McMahon, denismfmcmahon(at)gmail(dot)com

Report message to a moderator

[Message index]

		Security risks allowing users to upload a css file? By: Bhushan N.N on Wed, 15 May 2013 03:07
		Re: Security risks allowing users to upload a css file? By: Arno Welzel on Wed, 15 May 2013 10:12
		Re: Security risks allowing users to upload a css file? By: The Natural Philosoph on Wed, 15 May 2013 10:26
		Re: Security risks allowing users to upload a css file? By: Jerry Stuckle on Wed, 15 May 2013 10:35
		Re: Security risks allowing users to upload a css file? By: Denis McMahon on Wed, 15 May 2013 12:44
		Re: Security risks allowing users to upload a css file? By: Bhushan N.N on Wed, 15 May 2013 15:14

Previous Topic:	changing video source from youtube to my site
Next Topic:	Booleans compared to strings

Goto Forum:

-=] Back to Top [=-

[ Syndicate this forum (XML) ] [

]

Current Time: Sat Nov 30 23:22:59 GMT 2024

Total time taken to generate the page: 0.08279 seconds