te')); return $arr; } /* 遍历用户所有主题 * @param $uid 用户ID * @param int $page 页数 * @param int $pagesize 每页记录条数 * @param bool $desc 排序方式 TRUE降序 FALSE升序 * @param string $key 返回的数组用那一列的值作为 key * @param array $col 查询哪些列 */ function thread_tid_find_by_uid($uid, $page = 1, $pagesize = 1000, $desc = TRUE, $key = 'tid', $col = array()) { if (empty($uid)) return array(); $orderby = TRUE == $desc ? -1 : 1; $arr = thread_tid__find($cond = array('uid' => $uid), array('tid' => $orderby), $page, $pagesize, $key, $col); return $arr; } // 遍历栏目下tid 支持数组 $fid = array(1,2,3) function thread_tid_find_by_fid($fid, $page = 1, $pagesize = 1000, $desc = TRUE) { if (empty($fid)) return array(); $orderby = TRUE == $desc ? -1 : 1; $arr = thread_tid__find($cond = array('fid' => $fid), array('tid' => $orderby), $page, $pagesize, 'tid', array('tid', 'verify_date')); return $arr; } function thread_tid_delete($tid) { if (empty($tid)) return FALSE; $r = thread_tid__delete(array('tid' => $tid)); return $r; } function thread_tid_count() { $n = thread_tid__count(); return $n; } // 统计用户主题数 大数量下严谨使用非主键统计 function thread_uid_count($uid) { $n = thread_tid__count(array('uid' => $uid)); return $n; } // 统计栏目主题数 大数量下严谨使用非主键统计 function thread_fid_count($fid) { $n = thread_tid__count(array('fid' => $fid)); return $n; } ?>javascript - Is there any way to make user uploaded SVG images safe from code injection etc? - Stack Overflow

科技改变生活-雨落星辰 - 所有的伟大,都源于一个勇敢的开始

    最新消息：雨落星辰是一个专注网站SEO优化、网站SEO诊断、搜索引擎研究、网络营销推广、网站策划运营及站长类的自媒体原创博客
    你的位置： 首页>programmer>javascript - Is there any way to make user uploaded SVG images safe from code injection etc? - Stack Overflow

    javascript - Is there any way to make user uploaded SVG images safe from code injection etc? - Stack Overflow

    programmeradmin3浏览0评论

    I want to display user uploaded SVG images on a website, but they're quite open to exploits:

    For example, arbitrary javascript can be embedded in SVG. There's also issues with performance exploits, but I'd consider those lower priority.

    Is there any mechanism to make SVG somewhat safe and only use it as an image? Can I simply trust <img src="/media/user-uploaded-image.svg" />?

    Wikipedia/Wikimedia Commons hosts SVG files. Does anyone know what measures they take to prevent SVG exploits?

    I want to display user uploaded SVG images on a website, but they're quite open to exploits:

    • https://security.stackexchange./questions/11384/exploits-or-other-security-risks-with-svg-upload
    • https://security.stackexchange./questions/36447/img-tag-vulnerability

    For example, arbitrary javascript can be embedded in SVG. There's also issues with performance exploits, but I'd consider those lower priority.

    Is there any mechanism to make SVG somewhat safe and only use it as an image? Can I simply trust <img src="/media/user-uploaded-image.svg" />?

    Wikipedia/Wikimedia Commons hosts SVG files. Does anyone know what measures they take to prevent SVG exploits?

    • javascript
    • security
    • svg
    • code-injection
    Share Improve this question edited Oct 28, 2015 at 10:02 jozxyqk asked Oct 28, 2015 at 9:48 jozxyqkjozxyqk 17.3k15 gold badges98 silver badges197 bronze badges
    Add a ment  | 

    3 Answers 3

    Reset to default 9

    Wikipedia/Wikimedia Commons hosts SVG files. Does anyone know what measures they take to prevent SVG exploits?

    They serve the uploaded files from a separate hostname, specifically upload.wikimedia. You can cross-site-script into there all you like but it doesn't get you anything: it lives in a different origin to en.wikipedia and can't touch its cookies or interact with its script.

    This is ultimately the only airtight way to handle file uploads, and what most of the big players do. It is just too difficult to do a thorough scan for all the many obscure XSS possibilities that exist when you allow arbitrary files.

    Can I simply trust <img src="/media/user-uploaded-image.svg" />?

    It doesn't really matter what <img> does—the user can simply be navigated directly to the SVG address and it'll execute script full-page in the site's origin.

    If you embed SVGs as an <image> it shouldn't be able to execute scripts. See here: https://www.w3/wiki/SVG_Security

    Of course you can also parse the document before processing and apply the same filters and regex you would apply to an html file.

    Also note that (as I understand it) there is a vector of attack in the form of SVGs' ability to request arbitrary external images.

    与本文相关的文章

    发布评论

    评论列表(0)

    1. 暂无评论