Media component reporting 'Possible IE XSS Attack'

Question

I'm trying to upload two images to Joomla using the Media component, but one of the images will not upload and generates a notice -

Possible IE XSS Attack found.

The notice is generated in Firefox, Chrome and IE using Joomla version 3.4.8.

Image names - - ms-office-2016-check-intsall-01.png - ms-office-2016-check-intsall-01-thumb.png

I find this odd as the images are nearly identical; the thumbnail will upload just fine and was generated from the full size image, yet the full size image will not upload.

What I've tried -

• Renaming the image.
• Taking a copy of the image in my editor of choice, deleting the original and then saving the new image (both as the original name and a new name).

I've compared the Exif data of both images, just in case there is some random HTML in play in there, but the the data is exactly the same, bar the image name/path and dimensions.

Unfortunately I cannot simply delete the image and start from scratch as it is a screenshot that I cannot replicate.

Is anyone able to offer some insight in to this issue, and crucially suggest what I may do to fix it?

Answer 1

I know that's odd (still in Joomla 3.5.0). In the function canUpload($file, $component = 'com_media') of class JHelperMedia, this is within /libraries/cms/helper/media.php a check for serveral tags searches through the whole uploaded file(s). So if there is e.g. a tag ol like "<ol " or "<ol>" inside the raw picture file (case insensitive), the Error Possible IE XSS Attack found is shown.

• it checks for 116 strings: 'abbr', 'acronym', 'address', 'applet', 'area', 'audioscope', 'base', 'basefont', 'bdo', 'bgsound', 'big', 'blackface', 'blink', 'blockquote', 'body', 'bq', 'br', 'button', 'caption', 'center', 'cite', 'code', 'col', 'colgroup', 'comment', 'custom', 'dd', 'del', 'dfn', 'dir', 'div', 'dl', 'dt', 'em', 'embed', 'fieldset', 'fn', 'font', 'form', 'frame', 'frameset', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'head', 'hr', 'html', 'iframe', 'ilayer', 'img', 'input', 'ins', 'isindex', 'keygen', 'kbd', 'label', 'layer', 'legend', 'li', 'limittext', 'link', 'listing', 'map', 'marquee', 'menu', 'meta', 'multicol', 'nobr', 'noembed', 'noframes', 'noscript', 'nosmartquotes', 'object', 'ol', 'optgroup', 'option', 'param', 'plaintext', 'pre', 'rt', 'ruby', 's', 'samp', 'script', 'select', 'server', 'shadow', 'sidebar', 'small', 'spacer', 'span', 'strike', 'strong', 'style', 'sub', 'sup', 'table', 'tbody', 'td', 'textarea', 'tfoot', 'th', 'thead', 'title', 'tr', 'tt', 'ul', 'var', 'wbr', 'xml', 'xmp', '!DOCTYPE', '!--'

So you can reckon yourself how likely it is that a random hit exists! Especially with bigger images, and also with the one letter "s" or "S"; A remedy: You can use a tool for manipulating the image, e.g. the website tinypng.com where you can also make smart compression for PNG and JPG images. This will create a new binary for your image, and hopefully takes the upload.

There is also a functionality in Joomla - a class for Uploading files, which also uses special checking. This is the cause, that I can't use this file handling class JFile with that static function upload(). This class would be very comfortable in usage, but: The JFilterInput::isSafeFile is called, and when uploading a file e.g. 20 MB, its nearly every zip-file causing an error! Within that check, suspicious strings inside the raw zip-file i.e. "inc","phps","class","php3","php4","txt","dat","tpl", and "tmpl" cause a break and returns false for uploading.