Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am building a small web app in php, that accepts .doc /.docx / .rtf and .txt files. I've validated them against their mime-types. But now I'm thinking about virus scanning. I know there are systems like siteLock that can scan your systems for malware/viruses. I also know there are http://en.wikipedia.org/wiki/Clam_AntiVirus that I believe can be used to scan the stream as it's uploaded.

Is it necessary to also try and use Clam as the stream is uploaded? Not really sure here what is the best way forward?

Thanks for any help. My first post on here.

share|improve this question
    
'Validation Filters' are often quite thin. Making stuff look like other stuff is often possible; A B C –  lynks Aug 27 '13 at 16:11
    
There's some question here of what you are trying to accomplish, in re security, with this process. Have you done any threat modeling? It may help answer that question and inform yours. –  adric Aug 28 '13 at 13:11
add comment

3 Answers

up vote 2 down vote accepted

What do you mean by validating it against it's MIME-type? Mime typing is simply a way for an e-mail to make a claim as to the purpose and type of an attachment. It doesn't include any built in validation. MIME-type has nothing to do with viruses or virus scanning and a virus could still be sent through a Word document macro for example. So no, nothing to do with MIME type precludes the need to virus scan e-mail attachments.

share|improve this answer
    
I mean in the sense that when a user uploads a file. The application checks that the file has the correct mime_type. Something like this in PHP php.net/manual/en/function.finfo-file.php –  Jonnny Aug 27 '13 at 19:24
add comment

No, the "Content-Type" in the payload or request header can be spoofed, so don't trust it to match the actual type (much like you would not trust the file extension).

It is a good idea to virus scan files as an extra layer of protection but I would say it is more important to store them securely (e.g. writing them as byte data to a database rather than writing them to the file system where it may be possible to remotely execute them using another exploit). Practise defence in depth.

share|improve this answer
add comment

It depends on what your system does. If they're sending the files to you for viewing, then it's always a good idea to scan them for viruses - you don't know what people will have embedded in their files, particularly Word files as they can have dangerous macros. If you're facilitating communication between two unknown people, but not actually viewing the documents yourself (or just storing the documents for later retrieval by the same person) then you don't need to scan for viruses and the best course of action is to (assuming you're using *NIX to host the web app) not set the execute bit on the file permissions, as there's no reason for the files to be executed - you should actually do this for all the documents that are uploaded, regardless of purpose, since there's no reason for document files to be executed.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.