Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

I'm (still) working on a template-based XML editing program. It's a GUI-based XML editor that only allows users to add certain tags and attributes based off the requirements. You can see the current version here for an idea.

Now, I'd like to allow users to upload their own data templates, but I'm concerned about potential XSS hacks. Currently, the template file is in Javascript object literal notation, which unsurprisingly is a security nightmare if the user can upload their own. I was thinking of using XML instead, but is there an even better alternative?

share|improve this question
    
Are the users keying in information on your web site, or are they uploading files from their local systems. There is a big difference. –  Rice Flour Cookies May 31 '12 at 14:34
    
@RiceFlourCookies Uploading files from their local systems. –  Jeffrey Sweeney May 31 '12 at 14:56
add comment

1 Answer

As long as the only person to see what has been uploaded is the user who did that, then per definition it's not cross site scripting, and not a security issue. (The user can already break his own browser to his heart's content)

It might however become a usability issue, and you might want to protect the user from breaking your system through invalid templates.

Also, if you are thinking of possibly allowing users to share templates, then it might make sense to have a safe template system. This could however just mean that you parse the upload with a json parser (and possibly store the result of the parsing, not the original), and reject anything that fails the parser.

share|improve this answer
    
Thanks for replying. While the program is indeed only client-sided right now, I may implement some server-sided code in the future, so this is of some concern to me. I'm using the XMLParser to parse any uploaded XML, and I'm escaping certain <>&/; characters in the program's output. Is there anything I'm forgetting? –  Jeffrey Sweeney Jun 8 '12 at 13:33
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.