{"id":20,"date":"2004-09-08T09:00:14","date_gmt":"2004-09-08T09:00:14","guid":{"rendered":"http:\/\/lachy.id.au\/log\/2004\/09\/file-upload-security"},"modified":"2006-04-30T23:53:38","modified_gmt":"2006-04-30T23:53:38","slug":"file-upload-security","status":"publish","type":"post","link":"https:\/\/lachy.id.au\/log\/2004\/09\/file-upload-security","title":{"rendered":"File Upload Security"},"content":{"rendered":"

Recently, from a post sent by Peter-Paul Koch<\/a> to css-discuss<\/a>, I discovered a security flaw using <input type=\"file\"><\/code> controls, CSS<\/abbr> and JavaScript. Peter’s explained a techniqe<\/a> that allows authors to have more control over the style of file upload controls. For those of you who don’t know, browser vendors limit the amount of styling and DOM<\/abbr> access to file upload controls for security reasons. This technique can be used to make the user think they are simply entering text into an ordinary text box, when infact they are entering it into a file upload control.<\/p>\r\n\r\n

It works by positioning an ordinary text box underneath a file upload control and then setting opacity<\/code> for the file upload control to 0<\/code>:<\/p>\r\n\r\n

input.file {\r\n    \/* Assumes the file upload control has a\r\n     * class=\"file\" attribute\r\n     *\/\r\n    -moz-opacity: 0; \/* For Mozilla *\/\r\n    opacity: 0;      \/* For CSS3 compliant UAs including\r\n                      * recent Mozilla builds *\/\r\n    filter:alpha(opacity: 0); \/* For IE *\/\r\n}<\/code><\/pre>\r\n\r\n
JavaScript is used to copy the text from the file upload control to the text box behind, as it\u2019s entered by the user.  This security hole applies to Mozilla<\/a>, Firefox<\/a> and Internet Explorer<\/span>.<\/p>\r\n\r\n
I created some demonstrations<\/a> to show how this could potentially be used.  Combine that with the security holes discussed in bug 57770<\/a>, and that\u2019s quite a serious exploit.  I reported it on bugzilla<\/a>, and to Microsoft.  Although Microsoft\u2019s feedback mechanism was not very easy to find, I eventually found an e-mail address and actually recieved a prompt reply thanking me for taking the time to contact them with my constructive feedback (It was not just an automated response).  I’m yet to hear anything from Bugzilla, nor a reply to my post<\/a> to the WHAT-WG<\/abbr><\/a> mailing list<\/a>. Let me know how serious you think this is, or if you feel like putting it to some practical use<\/em>. ?<\/p>\r\n\r\n
PS. I still have 2 GMail invites available.  e-mail<\/a> me if you want one.<\/p>","protected":false},"excerpt":{"rendered":"Recently, from a post sent by Peter-Paul Koch to css-discuss, I discovered a security flaw using <input type=”file”> controls, CSS and JavaScript. Peter’s explained a techniqe that allows authors to have more control over the style of file upload controls. For those of you who don’t know, browser vendors limit the amount of styling and … Continue reading File Upload Security<\/span> →<\/span><\/a>","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[15,11,17,6],"tags":[],"_links":{"self":[{"href":"https:\/\/lachy.id.au\/log\/wp-json\/wp\/v2\/posts\/20"}],"collection":[{"href":"https:\/\/lachy.id.au\/log\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lachy.id.au\/log\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lachy.id.au\/log\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/lachy.id.au\/log\/wp-json\/wp\/v2\/comments?post=20"}],"version-history":[{"count":0,"href":"https:\/\/lachy.id.au\/log\/wp-json\/wp\/v2\/posts\/20\/revisions"}],"wp:attachment":[{"href":"https:\/\/lachy.id.au\/log\/wp-json\/wp\/v2\/media?parent=20"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lachy.id.au\/log\/wp-json\/wp\/v2\/categories?post=20"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lachy.id.au\/log\/wp-json\/wp\/v2\/tags?post=20"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}