The file-types tag has no wiki summary.
11
votes
3answers
1k views
How can I be protected from pictures vulnerabilities?
I've just read this question What is the corrupted image vulnerability? How does it work?
(GIFAR, EXIF data with javascript, etc..)
I'm asking myself how can I protect myself and my website's users.
...
7
votes
3answers
1k views
Using file extension and MIME type (as output by file -i -b) combination to determine unsafe files?
We allow users to upload a number of files, all of which we either send over to scribd (doc, xls, ppts, etc) or display as a video ourselves (flv, mov, mp4, etc in flowplayer).
To avoid users ...
12
votes
4answers
375 views
Is it safe to store and replay user-provided mime types?
If a user uploads a file but modifies the request by setting the mime-type to something arbitrary, like "superdangerous/blackhatstuff", is it safe for me to send the same mime type back to a different ...
13
votes
4answers
1k views
What is the corrupted image vulnerability? How does it work?
What exactly happens when someone injects malicious binary code into an image file (on Windows)? How is that done?
5
votes
2answers
532 views
Why should I restrict the content type of files be uploaded to my site?
We are building an application where users can upload resumes in our system for our administrators to download. We are having a debate about restricting the content type of the files that can be ...
6
votes
5answers
393 views
How should I serve untrusted / unsanitized documents (PDF, DOC, XLS) to end users over the web?
My website will be hosting documents for end users and I would like to make this as secure as possible.
Question
Assuming that I have a need to share documents on a website that may contain hostile ...
7
votes
1answer
210 views
Which files are more insecure than others?
Regarding the fact (in case it's not always the proven fact, then an opinion) that there are types of files more safe for handling them after getting from the Internet than the other, i'd like to ask:
...
