4 ms·

You're displaying HTML parts inline. This is both dangerous and unreliable. A much neater solution would be to take the HTML and convert it to a PDF using wkhtm

You're displaying HTML parts inline. This is both dangerous and unreliable. A much neater solution would be to take the HTML and convert it to a PDF using wkhtmltopdf: https://code.google.com/p/wkhtmltopdf/ https://code.google.com/p/wkhtmltopdf/ Then displaying the PDF to the end user. You can then generate a PNG or something from the PDF using ImageMagick, although the PDF retains the anchor tags and the PNG wouldn't... The way you're doing it at the moment, there are loads of ways of somebody malicious abusing the site.

mike-cardwell 15y ago
A couple of examples: I can send an HTML email with a script tag or object tags referencing an external JavaScript or Flash file, and it will happily pull that into the page and execute it within your DOM. Here are some demo XSS attacks: http://dudmail.com/emails/162551?mailbox=xss http://dudmail.com/emails/162551?mailbox=xss
davesmylie 15y ago
Hmmm. I did actually look at using wkhtmltopdf for another project so I'm sort of familiar with it at least. I do definitely see the concerns here, but I've not been able to think of a good way of handling them. I'm not sure how user friendly a pdf download would be. Chromium at least doesn't display them inline, so you'd have to view the email, get prompted to save it to disk, and then open it up using a pdf viewer... Do you think stripping out all the JS tags from the email before rendering it would be a safe enough solution?
- mike-cardwell 15y ago
  There are so many different ways of executing script. Just stripping out script tags isn't really enough. Here's another example which I've just tested with your service and works: <img src="#" onerror="alert('XSS')"> It's also possible to use SVG images with embedded javascript. You could generate a PNG from the PDF and display that inline in the page. You could then have a "(PDF Version with Clickable links)" link next to it?
  - davesmylie 15y ago
    That sounds more usable. I'll have a look into implementing that. Thanks heaps =)

mike-cardwell 15y ago

A couple of examples: I can send an HTML email with a script tag or object tags referencing an external JavaScript or Flash file, and it will happily pull that into the page and execute it within your DOM. Here are some demo XSS attacks: http://dudmail.com/emails/162551?mailbox=xss http://dudmail.com/emails/162551?mailbox=xss

davesmylie 15y ago

Hmmm. I did actually look at using wkhtmltopdf for another project so I'm sort of familiar with it at least. I do definitely see the concerns here, but I've not been able to think of a good way of handling them. I'm not sure how user friendly a pdf download would be. Chromium at least doesn't display them inline, so you'd have to view the email, get prompted to save it to disk, and then open it up using a pdf viewer... Do you think stripping out all the JS tags from the email before rendering it would be a safe enough solution?

mike-cardwell 15y ago
There are so many different ways of executing script. Just stripping out script tags isn't really enough. Here's another example which I've just tested with your service and works: <img src="#" onerror="alert('XSS')"> It's also possible to use SVG images with embedded javascript. You could generate a PNG from the PDF and display that inline in the page. You could then have a "(PDF Version with Clickable links)" link next to it?
- davesmylie 15y ago
  That sounds more usable. I'll have a look into implementing that. Thanks heaps =)