12
votes
5answers
1k views

Is there a way to check the filetype of a file uploaded using PHP?

I don't want it to just check the extension of the file as these can easily be forged even MIME types can be forged using tools like TamperData. So is there a better way to check file types in PHP ? ...
6
votes
5answers
660 views

How should I serve untrusted / unsanitized documents (PDF, DOC, XLS) to end users over the web?

My website will be hosting documents for end users and I would like to make this as secure as possible. Question Assuming that I have a need to share documents on a website that may contain hostile ...
5
votes
2answers
1k views

Why should I restrict the content type of files be uploaded to my site?

We are building an application where users can upload resumes in our system for our administrators to download. We are having a debate about restricting the content type of the files that can be ...
14
votes
4answers
693 views

Is it safe to store and replay user-provided mime types?

If a user uploads a file but modifies the request by setting the mime-type to something arbitrary, like "superdangerous/blackhatstuff", is it safe for me to send the same mime type back to a different ...
16
votes
3answers
2k views

How can I be protected from pictures vulnerabilities?

I've just read this question What is the corrupted image vulnerability? How does it work? (GIFAR, EXIF data with javascript, etc..) I'm asking myself how can I protect myself and my website's users. ...
10
votes
3answers
2k views

Using file extension and MIME type (as output by file -i -b) combination to determine unsafe files?

We allow users to upload a number of files, all of which we either send over to scribd (doc, xls, ppts, etc) or display as a video ourselves (flv, mov, mp4, etc in flowplayer). To avoid users ...