I am trying to display images (png, jpeg, gif, svg) directly on browser instead of letting the users downloading it. I've read from so many places that having content disposition header as inline might cause some security issues, and it is better to have it as attachment. Can anyone provide me a scenario where this might be a problem?
Hi @aemamateur ,
yes, the OSGi config "org.apache.sling.security.impl.ContentDispositionFilter" provides the way to disable it but it could lead to security issues and that's why it is enabled by default in the product.
Here are a few security issues can cause:
1. SVG images are vulnerable to XSS attacks
https://research.securitum.com/do-you-allow-to-load-svg-files-you-have-xss/
2. if a user with access (or attacker) was to upload an HTML or JS file into the DAM which could execute first party in the domain, they could circumvent JS browser protections like ORIGIN headers.
3. Also, check XSS Attack 4: Capture the keystrokes by injecting a keylogger
https://pentest-tools.com/blog/xss-attacks-practical-scenarios/
So, explore all the options in the above OSGI config like "Content Disposition Paths" & "Excluded Resource Paths" before disabling it for all files.
Hope it will help you.
Thanks
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.