0

I am creating a movie upload site, and I am wondering how I would verify that the movie I am uploading is in fact a movie. I know that getimagesize() will test images, so is there an equivalent of this for movies?

PS I am using Apache2 and PHP

closed as off-topic by schroeder Jan 7 '17 at 15:23

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – schroeder
If this question can be reworded to fit the rules in the help center, please edit the question.

  • This really isn't a security question – schroeder Jan 7 '17 at 15:23
1

Using getimagesize() is not made for testing if the file is an image. Just determining the type of known valid images. It is not meant for security, and can only be used as an extra check. A malicious file might make the function return a valid value while still being malicious, so that's no good.

OWASP is the go-to source for prevention and attack cheat sheets. This is the main point on file uploads:

The upload feature should be using a whitelist approach to only allow specific file types and extensions. However, it is important to be aware of the following file types that, if allowed, could result in security vulnerabilities.

"crossdomain.xml" allows cross-domain data loading in Flash, Java and Silverlight. If permitted on sites with authentication this can permit cross-domain data theft and CSRF attacks. Note this can get pretty complicated depending on the specific plugin version in question, so its best to just prohibit files named "crossdomain.xml" or "clientaccesspolicy.xml".

".htaccess" and ".htpasswd" provides server configuration options on a per-directory basis, and should not be permitted.

https://www.owasp.org/index.php/Input_Validation_Cheat_Sheet#File_Upload_Validation

More can be found here under prevention:

https://www.owasp.org/index.php/Unrestricted_File_Upload

But even this will fail if there's a vulnerability in the parsing code of your application ( stagefright for example )

Not the answer you're looking for? Browse other questions tagged or ask your own question.