0

I use UploadIfy to upload multiple files through ajax. Each time a file has been uploaded through an ajax request, and successfully saved on the server, I return the file name of that file to the client, BASE64 encoded.

I then add a DIV to the DOM where I use the BASE64 encoded file name as the value of a data attribute of that DIV, which I use as a unique reference to that DIV.

Secondly, I add an image to that DIV with an OnClick function to remove that file from the server through ajax, and I use that same BASE64 encoded filename as a parameter.

Example for an uploaded file 'test.pdf':

<div data-id="dGVzdC5wZGY="><img onclick="RemoveFile('dGVzdC5wZGY=')"/></div>

I access the the DIV using JQuery:

$("div[data-id='" + fn64 + "']")

where fn64 is the BASE64 encoded file name sent as a parameter.

Is there any way a user can create a filename which would break either my HTML or javascript? Or any other XSS risks? XSS is such a complicated matter that it's making me paranoid.

Zeep
  • 1
  • 3
    Probably not, but don’t use an inline `onclick` attribute and remove all doubt. A click listener attached to the image separately can read the `data-id` from its parent. Making producing HTML safe is easier than making producing JavaScript inside HTML safe. (Also, when you get rid of all inline JS like `onclick` attributes, you can start using a [CSP](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) as another line of defense against XSS.) – Ry- Mar 14 '19 at 16:29
  • https://stackoverflow.com/questions/15191401/base64-encode-escaping-or-not – raina77ow Mar 14 '19 at 16:30
  • @Ry- You're correct, I'll have it changed. – Zeep Mar 14 '19 at 16:58

1 Answers1

0

I cannot comment because I don not have 50 reputation points but.. Where is the base64 encoding taking place? is it on the server or the client? What does RemoveFile() look like?

I think if the input is encoded on server and then returned by the server you should be ok.

Also you could sanitize user input on the server to be extra safe.

I think more information is needed on how your code takes the file name and sends that to the server.

Zach Painter
  • 180
  • 1
  • 9
  • Yes, the BASE64 encoding of the filename is done at server, after the file has been saved, and then returned to the client. – Zeep Mar 14 '19 at 16:55