1

I'm (still) working on a template-based XML editing program. It's a GUI-based XML editor that only allows users to add certain tags and attributes based off the requirements. You can see the current version here for an idea.

Now, I'd like to allow users to upload their own data templates, but I'm concerned about potential XSS hacks. Currently, the template file is in Javascript object literal notation, which unsurprisingly is a security nightmare if the user can upload their own. I was thinking of using XML instead, but is there an even better alternative?

Improve this question
2
  • Are the users keying in information on your web site, or are they uploading files from their local systems. There is a big difference.
    – Vivian River
    May 31, 2012 at 14:34
  • @RiceFlourCookies Uploading files from their local systems.
    – Jeffrey Sweeney
    May 31, 2012 at 14:56

1 Answer 1

Reset to default
2

As long as the only person to see what has been uploaded is the user who did that, then per definition it's not cross site scripting, and not a security issue. (The user can already break his own browser to his heart's content)

It might however become a usability issue, and you might want to protect the user from breaking your system through invalid templates.

Also, if you are thinking of possibly allowing users to share templates, then it might make sense to have a safe template system. This could however just mean that you parse the upload with a json parser (and possibly store the result of the parsing, not the original), and reject anything that fails the parser.

Improve this answer
1
  • Thanks for replying. While the program is indeed only client-sided right now, I may implement some server-sided code in the future, so this is of some concern to me. I'm using the XMLParser to parse any uploaded XML, and I'm escaping certain <>&/; characters in the program's output. Is there anything I'm forgetting?
    – Jeffrey Sweeney
    Jun 8, 2012 at 13:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.