Alfresco and cross-site attack

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

warrenzhai

I am able to upload the following HTML document in Alfresco which may contain some malicious Javascript:

<html>
   <head>
   </head>

   <body>
      <script type="text/javascript">
         alert("You have been XSS attacked!");
      </script>
   </body>
</html>

Users who view this HTML document may inadvertently execute malicious JavaScript code in the background.  I am wondering what can be done to prevent this in Alfresco (1.3).

rdanner

I am able to upload the following HTML document in Alfresco which may contain some malicious Javascript:

<html>
   <head>
   </head>

   <body>
      <script type="text/javascript">
         alert("You have been XSS attacked!");
      </script>
   </body>
</html>

Users who view this HTML document may inadvertently execute malicious JavaScript code in the background.  I am wondering what can be done to prevent this in Alfresco (1.3).

You can write an action that executes when content is added to a space.  That action can filter for whatever you think could cause harm.