I have to create a routine that verify the content of a PDF File uploaded throughout an html Form. I check the content type, but if some malicious xss code is inserted into that PDF file, it is not detected. I'd like to know if there is a known way to avoid this problem. Should I use the java pdf library to verify the content??? I know that I could avoid the problem if I send a content disposition into the headers, but I can not do it.
Any suggestions are wellcome
You could host the file using a different virtual hostname, to limit the damage that XSS could do to your site. If you use domain cookies for anything you'd need a different DNS domain as well.
Regards, Brian
---------------------------------------------------------------------------- Join us on IRC: irc.freenode.net #webappsec