Google Talks About the Dangers of User Content

An anonymous reader writes "Here's an interesting article on the Google security blog about the dangers faced by modern web applications when hosting any user supplied data. The surprising conclusion is that it's apparently almost impossible to host images or text files safely unless you use a completely separate domain. Is it really that bad? "

Comments

Re:I don't know if the question should be...

[TubeSteak]

It's fundamentally a problem with not validating inputs. Without getting too technical...

Problem 1: Browsers try real hard to be clever and interpret maltagged/malformed content instead of validating inputs.

Problem 2: There are a lot of checks in most browsers against 'cross site scripting', which is fundamentally a problem of not validating inputs.

/don't forget to validate your outputs either.

Re:Yes, it really is that bad.

[SuricouRaven]

Of course it's a mess. The combination of HTTP and HTML was designed for simple, static documents displaying predominatly text, a little formatting and a few images. By this point we're using extensions to extensions to extensions. It's a miracle it works at all.