[Tiki-devel] SVG XSS

Hi Guys,

I noted that we block the use of SVG for gallery and similar use.

We can use SVG and prevent XSS if we do it right.

/*As my client's requirement was fixed, I had to come up with some
recommendations on ways they could defend against XSS attacks while
allowing the functionality (remember, security should enable, not say
"no"). After some discussions on the SANS GPWN list we came up with the
following ways a file could be accessed or displayed, as you can see,
some were safe but some were not and the JavaScript was executed.*/

  * Direct view - vulnerable - The file is linked to directly.
  * Direct view with content-disposition: attachment - not vulnerable -
    Headers are sent to force the file to be downloaded.
  * Direct view with CSP - not vulnerable - The Content Security Policy
    is set to disallow inline JavaScript.
  * Image Tags - not vulnerable - The SVG is referenced through image
    tags which prevent scripts.
  * Tags With CSP - not vulnerable - Image tags and the same CSP as
    above for double protection.

https://digi.ninja/blog/svg_xss.php

XSS Defense scenarios

https://svg.digi.ninja/svg <https://svg.digi.ninja/svg>

Code of github <https://github.com/digininja/svg_xss>

-- 
Polyna-Maude R.-Summerside
https://www.polynamaude.com/

-Be smart, Be wise, Support opensource development

*Mise en garde concernant la confidentialité*

La présente communication est confidentielle et transmise sous le sceau du
secret professionnel. Si vous n’êtes pas le destinataire visé ou son
mandataire chargé de lui transmettre cette communication, vous êtes par
les présentes avisées qu’il est expressément interdit d’en dévoiler la
teneur, de la copier, de la distribuer ou de prendre quelques mesures
fondées sur l’information qu’il y est contenu. Si vous aviez reçu cette
communication, par erreur, veuillez nous en aviser immédiatement par
téléphone (frais virés) et nous retourner l’original sans tirer ni garder
de copie, soit par la poste à l’adresse ci-haut mentionnée.

*Confidentiality Notice*

The information in this transmission may contain
privileged and confidential information and is intended only for the use
of the person or corporate entity to which it is addressed. The
confidential nature of this communication remains regardless of whether or
not you are an intended recipient. If you are not an intended recipient,
please notify the sender immediately and destroy this message and all
attachments, without making a copy. Any distribution or reproduction of
this message is prohibited. We assume no liability for the interception of
any Internet communication or the transmission of computer viruses.

/CP 99900 FJ 782 595
SUCC ST- DOMINIQUE
MONTRÉAL QC H2S 0E3
/

_______________________________________________
TikiWiki-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tikiwiki-devel