4 ms·
Would serving attachment previews from a separate domain, like fastmail-usercontent.fm, help?
by wulczer 14y ago
Would serving attachment previews from a separate domain, like fastmail-usercontent.fm, help?
- mike-cardwell 14y agoUsing a separate domain to display the attachments is a good idea. Gmail does it. It is mentioned towards the end of the blog post. However, that still doesn't get rid of the vulnerability, it just makes it less dangerous. There should be a strict whitelist of allowed content types, and anything not on that list should be download only. The trouble is, people tend to put "image/*" on that list, because they don't know what an SVG is or what it can do.