允许用户上传 HTML/JS 文件的风险
我们正在为 HTML5 游戏设计一个在线游乐场。用户可以上传包含其游戏的 zip 文件。
上传时，服务器会解压 zip 文件，并根据白名单循环检查其扩展名，允许：
- .html
- .js
- .png
- .jpg
- .appcache
- .m4a
- .ogg
（游戏必须在我们的游戏编辑器中制作，该编辑器导出这些文件文件）。这应该可以防止人们上传 zip、服务器端脚本文件等。
然后，游戏将被移至我们的静态无 cookie 域 (scirra.net)。当游戏在我们的 scirra.com 页面上玩时，游戏会显示在指向 scirra.net 域的 iframe 中。这应该可以防止恶意 JS 访问 scirra.com cookie。
这种 iframe 技术和白名单是否足够全面以防止任何恶意行为？请注意，我们无法真正筛选每个 JS 文件，因此我们应该假设人们会尝试上传恶意 JS。
We're designing an online aracade for HTML5 games. The users can upload a zip file which contains their game.
On upload, the zip is unpacked by the server and each file is looped checking it's extension against a white list allowing:
- .html
- .js
- .png
- .jpg
- .appcache
- .m4a
- .ogg
(Games must be made in our game editor which exports those files). This should prevent people uploading zips, server side script files etc etc.
The games are then moved onto our static cookieless domain (scirra.net). When the game is played on our scirra.com page the game is displayed in an iframe pointing to the scirra.net domain. This should prevent malicious JS from accessing scirra.com cookies.
Is this iframe technique and whitelist comprehensive enough to prevent anything malicious from being done? Note we can't really screen each JS file so we should assume people are going to try uploading malicious JS.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
iframe 的原始继承规则将阻止 scirra.net iframe干扰 scirra.com。
然而，这并不能阻止所有攻击。实际上，您引入了存储型 XSS 漏洞。 XSS 可用于引入基于浏览器的攻击，例如利用 ActiveX 组件中的缓冲区溢出。利用 Flash、Adobe reader 或 Microsoft Office 中的漏洞。
您应该考虑对 scirra.net 内容运行防病毒软件。尽管这并不能阻止所有攻击。 iram 页面可能会重定向或引入另一个包含恶意内容的 iframe。
正如 Cheeksoft 指出的那样。应用程序将能够通过 XSS 相互影响。恶意应用可以访问另一个应用离线存储或获取其他嵌入数据在另一个应用程序中。强制每个应用程序都有其子域将缓解此问题。您可以设置 DNS 记录以将 *.scirra.net 指向您的服务器并在您的 Web 应用程序中管理域名。
The origin inheritance rules for iframes will prevent the scirra.net iframe from interfering with scirra.com.
This however, does not prevent all attacks. In effect you are introducing a stored XSS vulnerability. XSS can be used to introduce browser based attacks, such as exploiting buffer overflows in ActiveX components. Exploiting falws in Flash, Adobe reader or Microsoft Office.
You should consider running an anti-virus on the scirra.net content. Although this won't prevent all attacks. The ifram'ed page could redirect or introduce another iframe that contains malicious content.
As Cheeksoft pointed out. Apps will be able to affect each other with XSS. A malcious app could gain access to another application offline storage or obtain other data embedded in another app. Forcing each app to have its on sub-domain will mitigate this issue. You could setup a DNS record to point *.scirra.net to your server and take care of the domain name within your web app.
在您提供的游戏编辑器中加入一些筛选功能怎么样？屏蔽对外部 URL 的引用、执行代码验证、检查编码等。
您必须锁定 zip 文件以防止篡改，但这可能是个好主意。
What about incorporating some screening features in the game editor that you supply? Screen out references to external URLs, perform code validation, check for encoding, etc.
You would have to lock down the zip file to prevent tampering, but that might be a good idea anyway.
对于阅读本文的其他人，有一个 experimental/beta iFrame 沙箱属性：
http://www.whatwg.org/specs/web-apps/current-work/multipage/the-iframe-element.html#attr-iframe-sandbox
请注意，它仅当前有效在 Chrome 和 Opera 上。这允许您指定一些限制功能。
然而，就我们的问题而言，我们已经放弃了这个想法，并决定，因为我们在拥有游戏创建程序方面处于有利地位，所以我们可以简单地让用户上传 Json 数据，保证核心的安全由我们托管的引擎功能。
我们可以手动审查和批准使用任何插件，这比手动批准每个游戏的工作要小得多。
For anyone else reading this, there is an experimental/beta iFrame sandbox attribute:
http://www.whatwg.org/specs/web-apps/current-work/multipage/the-iframe-element.html#attr-iframe-sandbox
Note it only currently works on Chrome and Opera. This allows you to specify some restricting features.
However in the case of our question we've scrapped the idea and have decided that because we are in the advantageous position of having a game creator program we can simply get the user to upload the Json data which is guaranteed to be safe with the core engine features being hosted by us.
Any plugins we can manually review and approve for use which is a much smaller job than manually approving every game.