Slashdot Mirror

← Back to Stories (view on slashdot.org)

Google Talks About the Dangers of User Content

Posted by samzenpus on from the watch-what-you-say dept.

An anonymous reader writes "Here's an interesting article on the Google security blog about the dangers faced by modern web applications when hosting any user supplied data. The surprising conclusion is that it's apparently almost impossible to host images or text files safely unless you use a completely separate domain. Is it really that bad? "

4 of 172 comments (clear)

  1. "user content" by Hazel+Bergeron · · Score: 1, Insightful

    Google's solution is effectively to make all content belong to Google.

    Gooooo cloud!

  2. Re:I don't know if the question should be... by TubeSteak · · Score: 5, Insightful

    It's fundamentally a problem with not validating inputs. Without getting too technical...

    Problem 1: Browsers try real hard to be clever and interpret maltagged/malformed content instead of validating inputs.

    Problem 2: There are a lot of checks in most browsers against 'cross site scripting', which is fundamentally a problem of not validating inputs.

    /don't forget to validate your outputs either.

    --
    [Fuck Beta]
    o0t!
  3. Re:Yes, it really is that bad. by SuricouRaven · · Score: 5, Insightful

    Of course it's a mess. The combination of HTTP and HTML was designed for simple, static documents displaying predominatly text, a little formatting and a few images. By this point we're using extensions to extensions to extensions. It's a miracle it works at all.

  4. Re:I don't know if the question should be... by Sarusa · · Score: 3, Insightful

    This is true! You could even say it's a sooper-dooper-fundamental problem of HTTP/HTML not sufficiently separating the control channel from the data channel and/or not sufficiently encapsulating things (active code anywhere? noooo.)

    But since browsers have actively chosen to validate invalid inputs and nobody's going to bother securing HTTP/HTML against this kind of thing any time soon, or fix the problems with cookies, or, etc etc etc, I figured that was a good enough high level summary of where we're at realistically. Nobody's willing to fix the foundations or 'break' when looking at malformed pages.