Data URL Scheme Support about htmlsanitizer HOT 7 CLOSED

Is this not a problem with IE's "great" MIME Type Detection ?

from htmlsanitizer.

But multimedia data type should be safe, no? for example audio, image, and video.

from htmlsanitizer.

or example, when a web application allows users to upload an image and only checks the file extension, the user can upload an image.jpg that actually contains HTML code. Older versions of Internet Explorer (especially versions 6 and 7) then render the file as HTML, which opened the possibility for a persistent Cross-Site Scripting (XSS) attack.

http://blog.fox-it.com/2012/05/08/mime-sniffing-feature-or-vulnerability/

Not sure if this counts for data uris

from htmlsanitizer.

I tried several case with image and script, also iframe tag in IE11 (MDN page says IE11 only support data URI for CSS, link, and img)

<img alt="Incorrect image using image/png data type" src="data:image/png;base64,amF2YXNjcmlwdDphbGVydCgnWFNTJyk7"/>
<img alt="Incorrect image using text/html data type contain javascript:alert('XSS');" src="data:text/html;base64,amF2YXNjcmlwdDphbGVydCgnWFNTJyk7"/>
<img alt="Incorrect image using text/html data type contain <script>alert('Hello');</script>" src="data:text/html;base64,PHNjcmlwdD5hbGVydCgiSGVsbG8iKTs8L3NjcmlwdD4="/>
<script src="data:text/html;base64,amF2YXNjcmlwdDphbGVydCgnWFNTJyk7"></script>
<iframe src="data:text/html;base64,PHNjcmlwdD5hbGVydCgiSGVsbG8iKTs8L3NjcmlwdD4="></iframe>

img tag doesn't expose XSS threat although using invalid mime type and data. SO I think above link doesn't count for data uris

Updated

from htmlsanitizer.

If you want to allow the data protocol, you can do so using the AllowedSchemes property. Potential problems with "wrong" MIME types apply equally to http, don't they? That is, if you allow img tags, you'll have to trust the browser because you have no control over what the server responds with.

from htmlsanitizer.

Agree on that :)

from htmlsanitizer.

Agreed too. Thanks for your explanation :)

from htmlsanitizer.