Timeline for Uploading images safe of XSS, php code and virus
Current License: CC BY-SA 3.0
7 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Aug 19, 2013 at 13:45 | vote | accept | Esteban | ||
| Aug 19, 2013 at 13:45 | comment | added | Esteban | After reading the 2nd point, now I'm using Imagick and the method stripImage() to remove all the extra info of the image and don't be susceptible to XSS in Exif data. With that, plus renaming files before saving, having the image folder without permissions to execute code, size limiting the images, the whitelist of extensions and using the nosniff header, I think it's ok now. Despite being the only answer, this is just what I needed, thanks again. | |
| Aug 18, 2013 at 10:12 | history | edited | buherator | CC BY-SA 3.0 |
elaborated on malware scanning, added permission settings
|
| Aug 17, 2013 at 12:45 | comment | added | Esteban | Thanks for your response. About the extension filtering, actually that's just 1 layer of protection, since just before saving the image I rename it, then it shouldn't be a problem because evil.php.jpg now will become MyRandomName.jpg and at least as far as I know, that shouldn't be executed as php code (and the images folder is configured to not execute php). About the image with virus, when I started reading about this, I found some questions about scanning uploaded files with possible virus, I thought that since they're not executable files shouldn't be any problem, but I was still worried. | |
| Aug 17, 2013 at 12:37 | history | edited | buherator | CC BY-SA 3.0 |
added 1 characters in body
|
| Aug 17, 2013 at 12:36 | comment | added | Brigand | About the .php.jpeg, it should also be noted to set user permissions to even octets (i.e. no execution ever), e.g., 644, and have a dedicated user own it if you won't delete it in PHP. Then once written, a separate poorly written PHP script can't make it executable or replace it with something else. | |
| Aug 17, 2013 at 12:05 | history | answered | buherator | CC BY-SA 3.0 |