-
Notifications
You must be signed in to change notification settings - Fork 199
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Is it safe to allow data URI's for img's? And best way to do it? #187
Comments
Your last question is actually covered in the wiki, to wit: var sanitizer = new HtmlSanitizer();
sanitizer.AllowedSchemes.Add("data"); |
AFAICT this might be a problem in older browsers: https://security.stackexchange.com/questions/165713/using-data-uris-to-perform-xss-in-anchor-tags-vulnerability |
@tiesont , my question was for whether a data uri was safe for specifically img tags? This post seems to say it is not a problem: https://security.stackexchange.com/a/83940/86412 Here is the code I used to handle this with HtmlSanitizer: static void FilterAttributes(object sender, RemovingAttributeEventArgs e)
{
if( (e.Tag.TagName == "IMG" && e.Attribute.Name.Equals("src")
&& (e.Attribute.Value.StartsWith("data:image/") || e.Attribute.Value.StartsWith("http") || e.Attribute.Value.StartsWith("https")))
|| (e.Tag.TagName.Equals("IFRAME") && e.Attribute.Name.Equals("src")))
{
e.Reason = RemoveReason.NotAllowedAttribute;
e.Cancel = true;
}
} and where I called it: sanitizer.AllowedAttributes.Remove("src");
sanitizer.RemovingAttribute += FilterAttributes; |
The link I referenced above is about There's nothing in the OWASP XSS Filter Evasion Cheat Sheet nor in the HTML5 Security Cheatsheet. The code looks ok; two minor things, though:
|
@mganss you just mentioned that |
@EvanSevy The In contrast, the |
@mganss -- Above is allowing all data URIs, where i need to allow only data:image URI. I don't want to allow other once like dat:text/html etc. Is it possible to allow only data:image? |
I've seen people discussing something similar in other issue posts, but not exactly.
My question is whether it is safe, particularly in regard to XSS, to allow data URI's within img tags?
I believe I'm going to allow img's from http and https. Are img's from a Data URI any less safe than img's from http/https?
How would I go about enabling this behavior of data URI's in img tags?
The text was updated successfully, but these errors were encountered: