Re: [WEB SECURITY] countermeasure against attacks through HTML shared files

Hi Francisco,

It would have been cool to mention Microsoft SharePoint as an example of
a popular file sharing system that allows persistent XSS through shared
HTML files. i.e.:<userID>/evil.html<siteName>/<SectionName>/evil.html

Where 'evil.html' would be a page containing JavaScript. i.e.:



Thanks for your paper btw.

fcorella@xxxxxxxxxx wrote:

I wanted to announce a Pomcor white paper that
looks at attacks through HTML shared files in Web
applications and proposes a countermeasure. These
are essentially XSS attacks, but the usual
defenses against XSS are typically not available,
because shared files cannot be sanitized.

The paper is available at:

I have not been able to find much prior work.
What I've found is discussed in Section 2 of the
paper. If I've missed something, please let me


Francisco Corella

Join us on IRC: #webappsec

Have a question? Search The Web Security Mailing List Archives:

Subscribe via RSS: [RSS Feed]

Join WASC on LinkedIn

Adrian P. | Senior IT Security Consultant | DDI: +44 (0)207 307 5026 |
PGP Key ID: 0x06E653A6

Relevant Pages