IE XSS.attack notification while trying to upload KML file

FLEXI_WARNIEXSS="Possible IE XSS Attack found."

It happens with the KML files.
I zipped and attached the one I'm testing on, so You can check it. Unzip before testing.

Regards.

Hello

yes i found the code it is inside FLEXIcontent upload file check

and indeed in this case it is a FALSE-POSITIVE

-- we need to revise the CODE

a temporary workaround (PLEASE don't hack other FLEXIcontent files)

is changing file:
components/com_flexicontent/classes/flexicontent.helper.php

and replacing line: with


A question: should the contents of uploaded files be checked ?

Works like a charm!

Thank Ggppdk for the support.
You are the best!

A question: should the contents of uploaded files be checked?

Maybe as an option, checked by default, but possible to disable. Just an idea.

Hello

--> ok i see/remember the reason now,

some could read the file and include it inside the page as HTML


so indeed someone can exploit the uploading of file to add XSS unsafe code into your page,

that is the reason that we check the uploaded files

e.g. we allow previewing of file in file field,

also in your case you will be printing the file inside you page ?


you should not allow public access to uploads

Thanks for the warning.

The site Administrator will only have the priviledge to upload the KML file. No public access for the upload.

Regards.