Re: [Plone-developers] Re: unsafe html via images

Previously Martin Aspeli wrote:
> On Sun, 08 Jan 2006 01:20:24 -0000, Wichert Akkerman  
> <[email protected]> wrote:
> >There are a couple of things we can do:
> >- decide that if you don't trust your member you should not enable
> >  member folders or other forms write access
> >
> >- have image fields verify if a real image was uploaded, possibly only
> >  if PIL is installed
> 
> Ick. Archetypes is a little too happy to accept various content types  
> sometimes :)

I wouldn't be surprised if ATAudio (for example) has the same problem.

> I'd say anything not of mimetype image/* should cause a validation error  
> on upload.

But how do you get the mimetype.. we obviously can't trust the filename.
And even if we could IE can happily ignore the mimetype and render as
html if it thinks your data looks like html.

MimeTypesRegistry looks like an obviousl place to guess this and it
already has some classification logic in place. How about expanding this
to:

- add a real classify method to MimeTypesRegistry; the current classify
  method will trust the passed-in mimetype and filename but since we can
  not trust those we can not use that
- check if the freedesktop classification list will handle all image
  format, and if not add a PIL-based classifier

Wichert.

-- 
Wichert Akkerman <[email protected]>    It is simple to make things.
http://www.wiggy.net/                   It is hard to make things simple.


-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click