# Security checks on uploads

**URL:** <https://meta.discourse.org/t/security-checks-on-uploads/26839>\
**Category:** Support\
**Created:** [26. März 2015 um 19:05 UTC](https://meta.discourse.org/t/security-checks-on-uploads/26839 "2015-03-26T19:05:11Z")\
**Posts on this page:** 1\
**Showing post:** 20

<div class="post-metadata">

**Author:** ![samhouston](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/samhouston/32/39271_2.png) [@samhouston](https://meta.discourse.org/u/samhouston)\
**Post date:** [31. März 2015 um 17:50 UTC](https://meta.discourse.org/t/security-checks-on-uploads/26839/20 "2015-03-31T17:50:43Z")

</div>

If I can upload an HTML page I can do what’s called a Cross Site Scripting (XSS) attack, as some browsers will render gifs as HTML. [Neal Poole from Facebook wrote about a Wordpress vuln like this back in 2011](https://nealpoole.com/blog/2011/04/file-upload-xss-vulnerability-in-wordpress/)

The HTML file could have javascript in it, which I could use to do bad things.

Again, I’m not a security researcher (though that’s what our community is made up of), so I can’t speak at length about XSS or test this thoroughly. I’m just wondering if you guys do anything to check headers of uploads. If you could answer that question for me, that would be awesome.

---

_[View the full topic](https://meta.discourse.org/t/security-checks-on-uploads/26839)._