Alfresco and cross-site attack

warrenzhai — Mon, 09 Apr 2007 15:24:33 GMT

I am able to upload the following HTML document in Alfresco which may contain some malicious Javascript:<html> <head> </head> <body> <script type="text/javascript"> alert("You have been XSS attacked!"); </script> </body></html>

Re: Alfresco and cross-site attack

rdanner — Mon, 16 Apr 2007 06:10:42 GMT

I am able to upload the following HTML document in Alfresco which may contain some malicious Javascript:

<html>
   <head>
   </head>

   <body>
      <script type="text/javascript">
         alert("You have been XSS attacked!");
      </script>
   </body>
</html>

Users who view this HTML document may inadvertently execute malicious JavaScript code in the background. I am wondering what can be done to prevent this in Alfresco (1.3).

You can write an action that executes when content is added to a space. That action can filter for whatever you think could cause harm.

topic Alfresco and cross-site attack in Alfresco Archive

Alfresco and cross-site attack

Re: Alfresco and cross-site attack