Hyland Connect

warrenzhai · ‎04-09-2007

I am able to upload the following HTML document in Alfresco which may contain some malicious Javascript:

<html>
   <head>
   </head>

   <body>
      <script type="text/javascript">
         alert("You have been XSS attacked!");
      </script>
   </body>
</html>

Users who view this HTML document may inadvertently execute malicious JavaScript code in the background. I am wondering what can be done to prevent this in Alfresco (1.3).

rdanner · ‎04-16-2007

I am able to upload the following HTML document in Alfresco which may contain some malicious Javascript:

<html>
   <head>
   </head>

   <body>
      <script type="text/javascript">
         alert("You have been XSS attacked!");
      </script>
   </body>
</html>

Users who view this HTML document may inadvertently execute malicious JavaScript code in the background. I am wondering what can be done to prevent this in Alfresco (1.3).

You can write an action that executes when content is added to a space. That action can filter for whatever you think could cause harm.

Hyland Connect

Alfresco and cross-site attack