Use PHP to check uploaded image file for malware?

Question

I want my users to be able to upload a photo. Currently I am not checking the uploaded photo for problems of any kind, although I do limit the size to 32k. Is there any way for me to check uploaded image files for malware? For instance, is there a server out there running ClamAV that I can access from PHP? Thanks.

Answer 1

This has been answered before on this site, in extensive detail. See these questions:

• What are the security risks of letting the users upload content to my site?
• Is it necessary to scan users' file uploads by antivirus?
• Antivirus for scanning anonymous file uploads
• What steps should be taken to validate user uploaded images within an application?
• What are security risks of serving user uploaded files without Content-Disposition?
• Why should I restrict the content type of files be uploaded to my site?
• Is it safe to store and replay user-provided mime types?
• Is it safe to serve any user uploaded file under only white-listed MIME content types?

For general advice relating to web security, OWASP is always a good resource, too.

Answer 2

Best I can think for PHP is to re-create the image, for example:

$src_file = '/your/tmp/image.tmp';
$dest_file = '/desired/file/location/img.jpg';
$img_quality = 70;

$im = imagecreatefromstring(file_get_contents($src_file));
$im_w = imagesx($im);
$im_h = imagesy($im);
$tn = imagecreatetruecolor($im_w, $im_h);
imagecopyresampled ( $tn , $im, 0, 0, 0, 0, $im_w, $im_h, $im_w, $im_h );
imagejpeg($tn,$dest_file,$img_quality);

Then delete the originally uploaded image and keep your resized copy.

Answer 3

As Christian says, ithe best solution is to whitelist and verify the file type - however any file which has uncompressed metadata can potentially be an avenue for attacking a webserver. Strip the metadata.

Invoking the virus checker synchronously from the web request is a very bad idea in terms of performance, stability and availability. While the default upload handler in PHP sensibly puts files out of the way and forces you to move them before the request completes - this means that you'll have to copy the file once more after you virus scan it.

Answer 4

I think that the best approach would be to use a combined solution:

• Scan the file using an antivirus
• Check the MIME type of the file
• Perform the file size check that Cristi described here
• Load the uploaded file into an image library and save it again (You may be already doing this if you are resizing the images)

By using all of these checks, the possibility of a successful attack would a lot smaller.

Answer 5

A good and popular practice is to check if the uploaded image is really an image and not something else. Validating an image is more secure than scanning with an antivirus.

The getimagesize() function will determine the size of any given image file and return the dimensions along with the file type and a height/width text string to be used inside a normal HTML IMG tag and the correspondent HTTP content type. The function supports many image formats.

You can use getimagesize() to accomplish multiple things at once:

• Validate that the file is an image
• Only allow some image types
• Only allow desired sizes

• Determine the MIME type of the image which can be used to deliver images with the correct HTTP Content-type header

  function is_image($path)
      {
      $a = getimagesize($path);
      $image_type = $a[2];
  
      if (in_array($image_type , array(IMAGETYPE_GIF , IMAGETYPE_JPEG ,IMAGETYPE_PNG , IMAGETYPE_BMP)))
      {
          return true;
      }
      return false;
  }
  

• $array[0] and $array[1] are the width and height of the image.

• $array[2] has the image type.

Note that MPEG videos are detected as IMAGETYPE_ICO.

Answer 6

Not a complete answer* but one way to filter out unwanted content would be to use PHP's image manipulation functions to transpose the uploaded image into a new image and then save that, rather than the uploaded data. A bit like taking a screenshot of a picture rather than just saving the picture directly.

*= Or the best solution, or easiest...