Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #9343

Re: Security risks allowing users to upload a css file?

Show all headers | View raw

Am 15.05.2013 05:07, schrieb Bhushan N.N:

> Are there any security risks involved in allowing a user to upload a css file? 

This depends on the way, how the CSS file is used on the server.

> I will be using the uploaded css file for a preview. Using another HTML template I already have on the server.

So - users can upload a file and this will be used by a
<link rel="stylesheet" type="text/css" href="..." />?

Well - it is possible to use CSS to obfuscate existing elements or even
to load data from other servers. So i would say - yes it is a risk if
you don't validate the CSS. It may not break your server, if it only
sends the data it stored earlier as a result of an upload - but it may
me misused by others to host fake websites on your machine.

-- 
Arno Welzel
http://arnowelzel.de
http://de-rec-fahrrad.de

Back to comp.lang.php | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Security risks allowing users to upload a css file? "Bhushan N.N" <bhushan154@gmail.com> - 2013-05-14 20:07 -0700
  Re: Security risks allowing users to upload a css file? Arno Welzel <usenet@arnowelzel.de> - 2013-05-15 12:12 +0200
  Re: Security risks allowing users to upload a css file? The Natural Philosopher <tnp@invalid.invalid> - 2013-05-15 11:26 +0100
  Re: Security risks allowing users to upload a css file? Jerry Stuckle <jstucklex@attglobal.net> - 2013-05-15 06:35 -0400
  Re: Security risks allowing users to upload a css file? Denis McMahon <denismfmcmahon@gmail.com> - 2013-05-15 12:44 +0000
  Re: Security risks allowing users to upload a css file? "Bhushan N.N" <bhushan154@gmail.com> - 2013-05-15 08:14 -0700

csiph-web