Is this safe?

Collapse
X
Collapse
 
  • Page of 1
  • Time
  • Show
Clear All
new posts
Previous template Next
  • The Duck
    Adult Content Provider
    • May 2005
    • 18243
    #1

    Is this safe?

    I am running a community driven website where I need to be able to have users submit html files through a contact form with file upload which forwards the file and message to my email. Is this safe or does it pose some kind of security threat if there is a rogue user who decides to upload an html file with malicious code?

    I have security apps on my computer I am more concerned if it can hurt my server in some way.
    Skype Horusmaia
    ICQ 41555245
    Email [email protected]
    Tags: None
    • seeandsee
      Check SIG!
      • Mar 2006
      • 50945
      #2
      maybe some java shit can go true, not sure is that just html files or scripting language too.
      BUY MY SIG - 50$/Year

      Contact here

        Comment

        • The Duck
          Adult Content Provider
          • May 2005
          • 18243
          #3
          Originally posted by seeandsee
          maybe some java shit can go true, not sure is that just html files or scripting language too.
          I will block everything but *.html files but I guess that can be exploited anyway.
          Skype Horusmaia
          ICQ 41555245
          Email [email protected]

            Comment

            • grumpy
              Too lazy to set a custom title
              • Jan 2002
              • 9870
              #4
              why do you need the submission of a complete html file? Easy to install exploits that way.
              Don't let greediness blur your vision | You gotta let some shit slide
              icq - 441-456-888

                Comment

                • pornguy
                  Too lazy to set a custom title
                  • Mar 2003
                  • 62910
                  #5
                  .htm and .html just incase
                  PornGuy skype me pornguy_epic

                  AmateurDough The Hottes Shemales online!
                  TChicks.com | Angeles Cid | Mariana Cordoba | MAILERS WELCOME!

                    Comment

                    • The Duck
                      Adult Content Provider
                      • May 2005
                      • 18243
                      #6
                      Originally posted by grumpy
                      why do you need the submission of a complete html file? Easy to install exploits that way.
                      I guess I could just have them submit the code in a text field but we are dealing with complete newbies so I fear they will not know how to extract the code from the html file as stupid as it may sounds.
                      Skype Horusmaia
                      ICQ 41555245
                      Email [email protected]

                        Comment

                        • StaceyJo
                          Confirmed User
                          • Mar 2008
                          • 8960
                          #7
                          Easy for spammers.
                          /_______ WebCashMaker ______\
                          | _TeenageDecadence - Young Board Naked Teens. |
                          | ____ NonNudeGirls - Female Puberty Photos. ____ |
                          | _ HerSelfPics - The ORIGINAL exGF SelfPic site. __ |
                          \.______ xPosing - Wife Photosharing site. _______./

                            Comment

                            • SilentSound
                              Confirmed User
                              • Mar 2009
                              • 287
                              #8
                              Take care - if your server is configured in that way, <?php ?> tags will be parsed with HTML files (depends on how you use the files after upload). Strip all code, be it PHP, ASP, etc. And strip ALL javascript. ALL of it.

                              That should be safe - I would use one more precaution though: don't allow anything referencing outer domains (eg. hotlinking an image for example from domain2.com, where the HTML file is uploaded to domain1.com) - this is a prime candidate for cookie stuffing.

                              Just my

                              take care !!!

                                Comment

                                • The Duck
                                  Adult Content Provider
                                  • May 2005
                                  • 18243
                                  #9
                                  Originally posted by SilentSound
                                  Take care - if your server is configured in that way, <?php ?> tags will be parsed with HTML files (depends on how you use the files after upload). Strip all code, be it PHP, ASP, etc. And strip ALL javascript. ALL of it.

                                  That should be safe - I would use one more precaution though: don't allow anything referencing outer domains (eg. hotlinking an image for example from domain2.com, where the HTML file is uploaded to domain1.com) - this is a prime candidate for cookie stuffing.

                                  Just my

                                  take care !!!
                                  Awesome, thanks a lot.
                                  Skype Horusmaia
                                  ICQ 41555245
                                  Email [email protected]

                                    Comment

                                    • SilentSound
                                      Confirmed User
                                      • Mar 2009
                                      • 287
                                      #10
                                      no prob mate, hit me up if you've got some scripting security issues, I have a lot of experience with this

                                        Comment

                                        • SilentSound
                                          Confirmed User
                                          • Mar 2009
                                          • 287
                                          #11
                                          just one more thought - why don't you get your users to edit HTML online, with an editor? (FCKEditor for example, but there are a lot out there) It would be WAY more safe...

                                            Comment

                                            Previous template Next
                                            Working...