0

On one legacy project the following pattern was implemented.

Visualforce page has div element with ondrop event handler which processes event.dataTransfer.files attribute to initiate FileReader with onloadend event handler and then method readAsDataURL is called. Then event.target.result is converted in String and substring from next symbol after comma is used as file content.

The file is being loaded then into third-party domain using $.ajax method of jQuery version 3.3.1 when security API Key and email credential is being sent in headers.

I think using Javascript for loading files from user browser to third-party system is insecure, since any requests between browser and destination server can be intercepted.

I guess I have seen somewhere such example as viable somewhere in the Salesforce documentation articles though but can't find right now.

However, the clients wonder about what is the maximum file size limit is on such approach.

So basically I have two questions.

  1. Is request invocation from frontend javascript to third-party system is secure and safe? If it is not, what exact security vulnerabilities this opens?
  2. What is the limit for file size when uploading files using Visualforce Javascript, HTML5 FileReader construct and jQuery ajax call?

1 Answer 1

0
  1. XSS vulnerability is found in jQuery 3.3.1 version https://security.snyk.io/package/npm/jquery/3.3.1

VULNERABILITY VULNERABLE VERSION M Cross-site Scripting (XSS) jquery is a package that makes things like HTML document traversal and manipulation, event handling, animation, and Ajax much simpler with an easy-to-use API that works across a multitude of browsers.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). Passing HTML from untrusted sources - even after

sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code.

How to fix Cross-site Scripting (XSS)?

Upgrade jquery to version 3.5.0 or higher.

\>=1.5.1 <3.5.0
M
Cross-site Scripting (XSS)
jquery is a package that makes things like HTML document traversal and manipulation, event handling, animation, and Ajax much simpler

with an easy-to-use API that works across a multitude of browsers.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) Passing HTML containing <option> elements from

untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code.

How to fix Cross-site Scripting (XSS)?

Upgrade jquery to version 3.5.0 or higher.

\>=1.5.1 <3.5.0
M
Prototype Pollution
jquery is a package that makes things like HTML document traversal and manipulation, event handling, animation, and Ajax much simpler

with an easy-to-use API that works across a multitude of browsers. Affected versions of this package are vulnerable to Prototype Pollution. The extend function can be tricked into modifying the prototype of Object when the attacker controls part of the structure passed to this function. This can let an attacker add or modify an existing property that will then exist on all objects.

Note: CVE-2019-5428 is a duplicate of CVE-2019-11358

How to fix Prototype Pollution?

Upgrade jquery to version 3.4.0 or higher.

So in particular it is not safe.

  1. Looks like the HTTP specification doesn't impose a specific size limit for posts. However it depends on the Web Server implementation or the programming technology used to process the form submission.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .