New answers tagged file-upload
The mistake isn't how you validate the file. You should never execute any file that is uploaded. Full stop. If an uploaded file is supposed to be an image, then the only thing you should do with it is present it to an image processing program to be opened. In a sense, the entire desktop paradigm of guessing the correct program to open a file by looking ...
Depending on the definition of "compromise", you might also want to check for "Zip bomb" attacks: a zip bomb allows the program to work as intended, but the archive is carefully crafted so that unpacking it (e.g. by a virus scanner in order to scan for viruses) requires inordinate amounts of time, disk space or memory.
First of all, I would suggest to perform some kind of content inspection (e.g. antivirus / malware detection) Second, I would read the files inside the ZIP file. Since you're using Python, I would suggest to have a look at: http://pymotw.com/2/zipfile/ By reading the content of the ZIP file, you could determine if the files are allowed or not (for example: ...
Top 50 recent answers are included